3 ms·

> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there. There is support for having the

by blep_ 4y ago

> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there. There is support for having the user authorize the device before logically connecting it to the rest of the system; see e.g. https://wiki.archlinux.org/title/Thunderbolt#User_device_authorization https://wiki.archlinux.org/title/Thunderbolt#User_device_aut... It would not surprise me if this does nothing, because firmware implements it poorly, and/or because users click OK on everything.

vetinari 4y ago
Device authorization for PCIe tunnels is TB3+ feature, older versions are out of luck. The situation with firmware is not that bad, though. There are exactly two of them, Intel and Apple. Apple devices have the Apple implementation and the rest of the world Intels. On capable hardware, IOMMU is also used (for all security levels).