4 ms·

Hacker Shows Us How to Unlock a Laptop Using an NSA Tool [video]

14 points by n3mes1s 10y ago

pritambaral 10y ago
They exploit Thunderbolt, whose insecure "All your memory are belong to us" model is known. I wonder what the attackers would use on a non-Thunderbolt laptop (say, a ThinkPad, or a regular Dell/HP/What-Have-You). Of course, using an Apple laptop to demo this makes a lot of sense: they are popular, almost ubiquitous, and they provide an external vector to full, direct memory access. But I don't think the scare factor holds up on a non-Apple device.
- deleted 10y ago
  [deleted]
- achr2 10y ago
  Thunderbolt-3 uses the USB-C port and is becoming prevalent in many non-apple latops.
  - dogma1138 10y ago
    USB-C isn't thunderbolt. The combine port is a different story but USB type-c is available for all USB revisions since 1.1. USB 3.1 allows for comaptibility with TB under certain configurations, it also has a DMA and PCIe pass trough on its own.
- Avery3R 10y ago
  Most laptops which don't have thunderbolt ports have a pci express card slot that's also vulnerable to DMA attacks.
  - pritambaral 10y ago
    Do you mean ExpressCard? I don't think I've seen a single laptop with an external PCIe slot. Even so, neither ExpressCard or internal PCIe are used for generic, everyday connectivity (like projectors / external screens). Thunderbolt on Apple laptops is marketed to be used for those.
iask 10y ago
Cool. I want that for Christmas.
n3mes1s 10y ago
some links related: - https://www.defcon.org/images/defcon-22/dc-22-presentations/Fitzpatrick-Crabill/DEFCON-22-Joe-FitzPatrick-Miles-Crabill-NSA-Playset-PCIe.pdf https://www.defcon.org/images/defcon-22/dc-22-presentations/... - https://www.youtube.com/watch?v=OD2Wxe4RLeU https://www.youtube.com/watch?v=OD2Wxe4RLeU
dogma1138 10y ago
If you have physical access it's game over. FireWire had this issue, so did express card, heck even if you don't have TB, express card or any other PCIe external interface. Open the laptop and either find an empty microPCIe slot or pull out the wireless card there is some risk of a BSOD but it works in many cases and voila you have DMA. That said bot Intel and AMD do have ways of encrypting memory regions which can prevent DMA attacks. Windows 10 has DMA port protection which enables the OS to restrict DMA access from external ports this is available from build 1507 but I'm not sure if it's enabled by default. Edit: looks like this is enabled by default when Bitlocker is enabled on recent builds.

14 points by n3mes1s 10y ago

They exploit Thunderbolt, whose insecure "All your memory are belong to us" model is known. I wonder what the attackers would use on a non-Thunderbolt laptop (say, a ThinkPad, or a regular Dell/HP/What-Have-You). Of course, using an Apple laptop to demo this makes a lot of sense: they are popular, almost ubiquitous, and they provide an external vector to full, direct memory access. But I don't think the scare factor holds up on a non-Apple device.

deleted 10y ago
[deleted]
achr2 10y ago
Thunderbolt-3 uses the USB-C port and is becoming prevalent in many non-apple latops.
- dogma1138 10y ago
  USB-C isn't thunderbolt. The combine port is a different story but USB type-c is available for all USB revisions since 1.1. USB 3.1 allows for comaptibility with TB under certain configurations, it also has a DMA and PCIe pass trough on its own.
Avery3R 10y ago
Most laptops which don't have thunderbolt ports have a pci express card slot that's also vulnerable to DMA attacks.
- pritambaral 10y ago
  Do you mean ExpressCard? I don't think I've seen a single laptop with an external PCIe slot. Even so, neither ExpressCard or internal PCIe are used for generic, everyday connectivity (like projectors / external screens). Thunderbolt on Apple laptops is marketed to be used for those.

iask 10y ago

Cool. I want that for Christmas.

n3mes1s 10y ago

some links related: - https://www.defcon.org/images/defcon-22/dc-22-presentations/Fitzpatrick-Crabill/DEFCON-22-Joe-FitzPatrick-Miles-Crabill-NSA-Playset-PCIe.pdf https://www.defcon.org/images/defcon-22/dc-22-presentations/... - https://www.youtube.com/watch?v=OD2Wxe4RLeU https://www.youtube.com/watch?v=OD2Wxe4RLeU

dogma1138 10y ago

If you have physical access it's game over. FireWire had this issue, so did express card, heck even if you don't have TB, express card or any other PCIe external interface. Open the laptop and either find an empty microPCIe slot or pull out the wireless card there is some risk of a BSOD but it works in many cases and voila you have DMA. That said bot Intel and AMD do have ways of encrypting memory regions which can prevent DMA attacks. Windows 10 has DMA port protection which enables the OS to restrict DMA access from external ports this is available from build 1507 but I'm not sure if it's enabled by default. Edit: looks like this is enabled by default when Bitlocker is enabled on recent builds.