6 ms·

Security issues, most likely. Like Firewire, Thunderbolt suffers from the same security issue in that to achieve its high speeds, it gives connected devices dir

Security issues, most likely. Like Firewire, Thunderbolt suffers from the same security issue in that to achieve its high speeds, it gives connected devices direct memory access. In other words, any connected device can read and write directly from your RAM, bypassing any kind of access control built into the OS. https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulnerability_to_DMA_attacks https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Vulner...

dogma1138 9y ago
Not for security reasons at all but rather so you’ll have to buy Apple made devices like their own external GPU enclosure. Their restriction does not prevents actual DMA attacks at all just specifically limits high end TB3 devices.
- abakker 9y ago
  Apple does not make a GPU enclosure, and does support external ones. I have a sonnet one with an rx580 in it. Works fine for me.
  - dogma1138 9y ago
    >Apple does not make a GPU enclosure Are you fucking kidding me? https://developer.apple.com/development-kit/external-graphics/ https://developer.apple.com/development-kit/external-graphic... Apple has been specifically targeting competing TB3 devices they do not white list but rather black list their competition. And what is even more obvious is that they do not block TB2/1 devices at all which are the ones used for all the publicly available DMA attack toolkits like Inception. This has nothing to do with security.
    - abakker 9y ago
      That enclosure is made by Sonnet, and the card is made by AMD. They make neither. They just say that they support it specifically as they roll out support of eGPU generally. So, no, I am not kidding you. That Apple dev kit costs the same as buying the components separately, or have you not looked at that possibility?
      - dogma1138 9y ago
        They began blacklisting 3rd party enclosures shortly before it’s announcement. They do not restrict TB1/2 devices at all (including a TB2 GPU enclosure like the one I’ve been using for over 3 years) which have the same DMA access as TB3 the only difference is the speed of the PCIe lanes. But sure tell me how this is done for security. If Apple cared about security they would implement the same port and DMA protection MSFT has with Win10. But this is purely for business gains.
        DRW_ 9y ago
        These third party blocks have been in place since the first Thunderbolt 3 Mac launched. They didn't start blocking anything in particular 'shortly' before they announced this dev kit at all. These third party devices that Apple blocked were not just enclosures, there were other TB3 devices (e.g. dual display adapters) that Apple to this day have not announced or endorsed a competitor to, and in fact those same companies (e.g. StarTech) then released Mac compatible versions, which suggests Apple were just enforcing a standard that they wanted OEMs to meet before allowing them to work by default. The blocks have been found to be based on an earlier chipset version, and that devices made using later versions of the TB3 chipset work just fine. This is what a peripheral manufacturer said (Plugable): The version of OS X on the new MacBook Pros (late 2016) will not work with existing Thunderbolt 3 docks and adapters that were certified for Windows prior to the release of the MacBook Pro. These existing devices use first generation of TI USB-C chipset (TPS65982) in combination with Intel’s Thunderbolt 3 chipset (Alpine Ridge). Apple requires the 2nd generation TPS65983 chipset for peripherals to be compatible. Certification of solutions across different device types is still in-progress for this 2nd generation chipset. From the Plugable product line, our dual display graphics adapters for DisplayPort and HDMI (TBT3-DP2X and TBT3-HDMI2X) are affected… We’ve also postponed our TBT3-UD1 Docking Station to update to the TPS65983 chipset and re-certify to make this docking station MacBook-compatible. Our Flagship TBT3-UDV dock with Power Delivery/Charging was already planned to use the next generation controller chip from TI, and will be compatible with the 2016 Thunderbolt 3 MacBooks. This does still fit with your argument?
        9y ago
    - dang 9y ago
      > Are you fucking kidding me? This breaks the site guidelines. Please keep that sort of thing out of your comments here! The rest of your comment is just fine. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
wyager 9y ago
That doesn’t make sense. Attackers will just pretend to be one of the permitted devices. There are also hardware mitigations to make DMA safe(r) now. https://en.m.wikipedia.org/wiki/Input–output_memory_management_unit https://en.m.wikipedia.org/wiki/Input–output_memory_manageme...
- txcwpalpha 9y ago
  > That doesn’t make sense. Attackers will just pretend to be one of the permitted devices. I don't have much knowledge on how the block actually works, but I would assume it's not trivial to "just pretend to be one of the permitted devices." > There are also hardware mitigations to make DMA safe(r) now. From what I can tell, IOMMU is not supported on any of the CPUs used by Thunderbolt-capable MacBooks.
  - wyager 9y ago
    > but I would assume it's not trivial to "just pretend to be one of the permitted devices." Your assumption is incorrect. Even for devices that are designed with the express purpose of being hard to emulate (auth tokens, DRM chips, iPhone cables), it’s at most a simple matter of a grad student or Shenzhen resident with access to a fume hood and an electron microscope finding some burned-in private keys. For devices that aren’t designed to resist emulation, which thunderbolt devices generally aren’t, it’s trivial. This is essentially one of the core messages you should take away from the field of hardware security. > IOMMU is not supported on any of the CPUs used by Thunderbolt-capable MacBooks. They all do. Intel calls it VT-d.
    - darpa_escapee 9y ago
      I have a MacBook with processor that supports VT-d according to ARC. I cannot use VT-d features.
    - txcwpalpha 9y ago
      >Your assumption is incorrect. Even for devices that are designed with the express purpose of being hard to emulate (auth tokens, DRM chips, iPhone cables), it’s at most a simple matter of a grad student or Shenzhen resident with access to a fume hood and an electron microscope finding some burned-in private keys. For devices that aren’t designed to resist emulation, which thunderbolt devices generally aren’t, it’s trivial. This is essentially one of the core messages you should take away from the field of hardware security. Every source that I can find regarding the 2016 DMA vulnerabilities disagrees with you. Most of them actually specifically require that Thunderbolt security features be turned off because otherwise signed drivers are required to be installed before the peripheral will even connect. >They all do. Intel calls it VT-d. Got a source for VT-d being supported on MacBooks? I've been looking pretty hard to find a definitive answer, but all I can find are random unverified forum posts, stackoverflow questions, blackhat presentations, etc, and all of them say that VT-d and IOMMU are not supported/enabled on recent MacBooks and MB Pros. edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...
userbinator 9y ago
Thunderbolt is basically external PCIe, so that's not surprising. Quite frankly, I'm not worried about physical access being a "vulnerability" --- I'm of the "if you physically own it, you should logically own it" mindset.
- serf 9y ago
  >I'm of the "if you physically own it, you should logically own it" mindset. I agree with the premise, but accepting that as a truism sure makes running an off-site server rough.
- lawl 9y ago
  While I mostly agree with this, I don't agree here. Maybe you need to connect your notebook to a projector and they hand you a thunderbolt to hdmi cable. They don't phsically own your device and yet you're possibly fucked.
  - Klathmon 9y ago
    Couldn't a simple OS "permissions" system mostly fix that loophole (as much as it can be fixed)? "[device name] is requesting [scary sounding permission] Allow?" It won't protect users from themselves, but it will protect "bad-usb" style attacks.
    - toyg 9y ago
      I still have to meet the user who will ever click “No” at one of those prompts.
      - Klathmon 9y ago
        Well please let me introduce you to some of our clients that click "no" to the "[b2b app] is requesting permission to use your camera to scan barcodes" about 40% of the time according to our analytics... But in all seriousness, I agree that it's far from perfect, however I still think there is a way to allow the possibility without almost completely giving up on security.
walterbell 9y ago
Pre-logon DMA attacks were addressed by Apple in Dec 2016, https://9to5mac.com/2016/12/19/mac-thunderbolt-password/ https://9to5mac.com/2016/12/19/mac-thunderbolt-password/
poizan42 9y ago
Doesn't apple use IOMMUs? Are there actually motherboards out there with TB3 support but without IOMMU?
- txcwpalpha 9y ago
  AFAIK Apple uses a custom motherboard for their machines, so I'm not sure where to look for specs on if the mobos support IOMMU/VT-d, but from what I can find, IOMMU/VT-d is not supported on any of the CPUs used in TB3-capable MBs, and it needs to be supported by both CPU and mobo for it to work.
  - X-Istence 9y ago
    http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Apple in MacOS is using IOMMU to protect against Firewire/Thunderbolt attacks. Here's a developer working on xhyve that is explaining how each PCI device has it's own VT-d mapper/domain: https://github.com/mist64/xhyve/issues/108#issuecomment-359266598 https://github.com/mist64/xhyve/issues/108#issuecomment-3592...
    - txcwpalpha 9y ago
      Interesting, I've been doing lots of searching and all I can find is forum or blog posts of unverified people, some saying that VT-d is enabled, but most saying it is not supported/enabled. In fact, if you look at the presentation by Russ Sevinsky that is referenced in your first link, it is specifically said that Apple hardware does not support IOMMU [1]. So I really don't know what to think. 1: https://youtu.be/q0HthE3qDMw?t=415 https://youtu.be/q0HthE3qDMw?t=415 edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...
Fice 9y ago
> any connected device can read and write directly from your RAM Which means that unrestricted Thunderbolt can be used to access DRM-protected data...

dogma1138 9y ago

Not for security reasons at all but rather so you’ll have to buy Apple made devices like their own external GPU enclosure. Their restriction does not prevents actual DMA attacks at all just specifically limits high end TB3 devices.

abakker 9y ago
Apple does not make a GPU enclosure, and does support external ones. I have a sonnet one with an rx580 in it. Works fine for me.
- dogma1138 9y ago
  >Apple does not make a GPU enclosure Are you fucking kidding me? https://developer.apple.com/development-kit/external-graphics/ https://developer.apple.com/development-kit/external-graphic... Apple has been specifically targeting competing TB3 devices they do not white list but rather black list their competition. And what is even more obvious is that they do not block TB2/1 devices at all which are the ones used for all the publicly available DMA attack toolkits like Inception. This has nothing to do with security.
  - abakker 9y ago
    That enclosure is made by Sonnet, and the card is made by AMD. They make neither. They just say that they support it specifically as they roll out support of eGPU generally. So, no, I am not kidding you. That Apple dev kit costs the same as buying the components separately, or have you not looked at that possibility?
    - dogma1138 9y ago
      They began blacklisting 3rd party enclosures shortly before it’s announcement. They do not restrict TB1/2 devices at all (including a TB2 GPU enclosure like the one I’ve been using for over 3 years) which have the same DMA access as TB3 the only difference is the speed of the PCIe lanes. But sure tell me how this is done for security. If Apple cared about security they would implement the same port and DMA protection MSFT has with Win10. But this is purely for business gains.
      - DRW_ 9y ago
        These third party blocks have been in place since the first Thunderbolt 3 Mac launched. They didn't start blocking anything in particular 'shortly' before they announced this dev kit at all. These third party devices that Apple blocked were not just enclosures, there were other TB3 devices (e.g. dual display adapters) that Apple to this day have not announced or endorsed a competitor to, and in fact those same companies (e.g. StarTech) then released Mac compatible versions, which suggests Apple were just enforcing a standard that they wanted OEMs to meet before allowing them to work by default. The blocks have been found to be based on an earlier chipset version, and that devices made using later versions of the TB3 chipset work just fine. This is what a peripheral manufacturer said (Plugable): The version of OS X on the new MacBook Pros (late 2016) will not work with existing Thunderbolt 3 docks and adapters that were certified for Windows prior to the release of the MacBook Pro. These existing devices use first generation of TI USB-C chipset (TPS65982) in combination with Intel’s Thunderbolt 3 chipset (Alpine Ridge). Apple requires the 2nd generation TPS65983 chipset for peripherals to be compatible. Certification of solutions across different device types is still in-progress for this 2nd generation chipset. From the Plugable product line, our dual display graphics adapters for DisplayPort and HDMI (TBT3-DP2X and TBT3-HDMI2X) are affected… We’ve also postponed our TBT3-UD1 Docking Station to update to the TPS65983 chipset and re-certify to make this docking station MacBook-compatible. Our Flagship TBT3-UDV dock with Power Delivery/Charging was already planned to use the next generation controller chip from TI, and will be compatible with the 2016 Thunderbolt 3 MacBooks. This does still fit with your argument?
        9y ago
  - dang 9y ago
    > Are you fucking kidding me? This breaks the site guidelines. Please keep that sort of thing out of your comments here! The rest of your comment is just fine. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

wyager 9y ago

That doesn’t make sense. Attackers will just pretend to be one of the permitted devices. There are also hardware mitigations to make DMA safe(r) now. https://en.m.wikipedia.org/wiki/Input–output_memory_management_unit https://en.m.wikipedia.org/wiki/Input–output_memory_manageme...

txcwpalpha 9y ago
> That doesn’t make sense. Attackers will just pretend to be one of the permitted devices. I don't have much knowledge on how the block actually works, but I would assume it's not trivial to "just pretend to be one of the permitted devices." > There are also hardware mitigations to make DMA safe(r) now. From what I can tell, IOMMU is not supported on any of the CPUs used by Thunderbolt-capable MacBooks.
- wyager 9y ago
  > but I would assume it's not trivial to "just pretend to be one of the permitted devices." Your assumption is incorrect. Even for devices that are designed with the express purpose of being hard to emulate (auth tokens, DRM chips, iPhone cables), it’s at most a simple matter of a grad student or Shenzhen resident with access to a fume hood and an electron microscope finding some burned-in private keys. For devices that aren’t designed to resist emulation, which thunderbolt devices generally aren’t, it’s trivial. This is essentially one of the core messages you should take away from the field of hardware security. > IOMMU is not supported on any of the CPUs used by Thunderbolt-capable MacBooks. They all do. Intel calls it VT-d.
  - darpa_escapee 9y ago
    I have a MacBook with processor that supports VT-d according to ARC. I cannot use VT-d features.
  - txcwpalpha 9y ago
    >Your assumption is incorrect. Even for devices that are designed with the express purpose of being hard to emulate (auth tokens, DRM chips, iPhone cables), it’s at most a simple matter of a grad student or Shenzhen resident with access to a fume hood and an electron microscope finding some burned-in private keys. For devices that aren’t designed to resist emulation, which thunderbolt devices generally aren’t, it’s trivial. This is essentially one of the core messages you should take away from the field of hardware security. Every source that I can find regarding the 2016 DMA vulnerabilities disagrees with you. Most of them actually specifically require that Thunderbolt security features be turned off because otherwise signed drivers are required to be installed before the peripheral will even connect. >They all do. Intel calls it VT-d. Got a source for VT-d being supported on MacBooks? I've been looking pretty hard to find a definitive answer, but all I can find are random unverified forum posts, stackoverflow questions, blackhat presentations, etc, and all of them say that VT-d and IOMMU are not supported/enabled on recent MacBooks and MB Pros. edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...

userbinator 9y ago

Thunderbolt is basically external PCIe, so that's not surprising. Quite frankly, I'm not worried about physical access being a "vulnerability" --- I'm of the "if you physically own it, you should logically own it" mindset.

serf 9y ago
>I'm of the "if you physically own it, you should logically own it" mindset. I agree with the premise, but accepting that as a truism sure makes running an off-site server rough.
lawl 9y ago
While I mostly agree with this, I don't agree here. Maybe you need to connect your notebook to a projector and they hand you a thunderbolt to hdmi cable. They don't phsically own your device and yet you're possibly fucked.
- Klathmon 9y ago
  Couldn't a simple OS "permissions" system mostly fix that loophole (as much as it can be fixed)? "[device name] is requesting [scary sounding permission] Allow?" It won't protect users from themselves, but it will protect "bad-usb" style attacks.
  - toyg 9y ago
    I still have to meet the user who will ever click “No” at one of those prompts.
    - Klathmon 9y ago
      Well please let me introduce you to some of our clients that click "no" to the "[b2b app] is requesting permission to use your camera to scan barcodes" about 40% of the time according to our analytics... But in all seriousness, I agree that it's far from perfect, however I still think there is a way to allow the possibility without almost completely giving up on security.

walterbell 9y ago

Pre-logon DMA attacks were addressed by Apple in Dec 2016, https://9to5mac.com/2016/12/19/mac-thunderbolt-password/ https://9to5mac.com/2016/12/19/mac-thunderbolt-password/

poizan42 9y ago

Doesn't apple use IOMMUs? Are there actually motherboards out there with TB3 support but without IOMMU?

txcwpalpha 9y ago
AFAIK Apple uses a custom motherboard for their machines, so I'm not sure where to look for specs on if the mobos support IOMMU/VT-d, but from what I can find, IOMMU/VT-d is not supported on any of the CPUs used in TB3-capable MBs, and it needs to be supported by both CPU and mobo for it to work.
- X-Istence 9y ago
  http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-attacks-on-os-x.html http://ilostmynotes.blogspot.com/2014/11/thunderbolt-dma-att... Apple in MacOS is using IOMMU to protect against Firewire/Thunderbolt attacks. Here's a developer working on xhyve that is explaining how each PCI device has it's own VT-d mapper/domain: https://github.com/mist64/xhyve/issues/108#issuecomment-359266598 https://github.com/mist64/xhyve/issues/108#issuecomment-3592...
  - txcwpalpha 9y ago
    Interesting, I've been doing lots of searching and all I can find is forum or blog posts of unverified people, some saying that VT-d is enabled, but most saying it is not supported/enabled. In fact, if you look at the presentation by Russ Sevinsky that is referenced in your first link, it is specifically said that Apple hardware does not support IOMMU [1]. So I really don't know what to think. 1: https://youtu.be/q0HthE3qDMw?t=415 https://youtu.be/q0HthE3qDMw?t=415 edit: I finally came across the below link from Apple which does seem to imply that IOMMU VT-d is enabled on Macs that are 2012 and newer. On anything before that, though, and DMA attacks could own you. So uh.. don't run macbooks that are 6 years old, I guess. https://developer.apple.com/library/content/documentation/HardwareDrivers/Conceptual/ThunderboltDevGuide/DebuggingThunderboltDrivers/DebuggingThunderboltDrivers.html https://developer.apple.com/library/content/documentation/Ha...

Fice 9y ago

> any connected device can read and write directly from your RAM Which means that unrestricted Thunderbolt can be used to access DRM-protected data...