TechBizWebTechBizWeb

    Subscribe to Updates

    Get the latest news about Technology and Business from all around the web..

    What's Hot

    Hong Kong elite descends on Tokyo for bargain property buys

    June 29, 2022

    Sony’s InZone gaming monitors and headsets are for more than just PS5 gamers

    June 29, 2022

    Ripple Labs Inc Floats CBDC Innovate Challenge

    June 29, 2022
    Facebook Twitter Instagram
    • About Us
    • Privacy Policy
    • Guest Post
    • Terms
    • Contact
    Facebook Twitter Instagram
    TechBizWebTechBizWeb
    Subscribe
    • Home
    • Technology

      Sony’s InZone gaming monitors and headsets are for more than just PS5 gamers

      June 29, 2022

      Pinterest has a new CEO, who has one job: to build the internet’s shopping mall

      June 29, 2022

      Montblanc Summit 3 will be the first Wear OS 3 smartwatch for iOS

      June 29, 2022

      Gmail’s new look is about to appear for more people, even if they didn’t ask for it

      June 29, 2022

      Are Hyper’s stackable USB-C chargers melting?

      June 28, 2022
    • Business
    • Cyber Security

      Hybrid work transition reveals low enterprise cybersecurity confidence

      June 28, 2022

      Ransomware in Q1 2022 doubled total 2021 volume

      June 28, 2022

      Lithuania hit by DDoS cyberattack

      June 28, 2022

      2 out of 3 European citizens welcome digital ID wallet

      June 28, 2022

      87% of executives have no cybersecurity tools on personal devices

      June 27, 2022
    • Blockchain
    • Vulnerabilities
    • Social Engineering
    • Malware
    • Cyber Security Alerts
    TechBizWebTechBizWeb
    Home»Cyber Security»‘Thunderclap’ Flaws Expose Computers to Attacks via Peripheral Devices
    Cyber Security

    ‘Thunderclap’ Flaws Expose Computers to Attacks via Peripheral Devices

    February 27, 2019Updated:February 27, 2019No Comments4 Mins Read
    Facebook Twitter Pinterest LinkedIn Tumblr WhatsApp
    Share
    Facebook Twitter LinkedIn Pinterest Email


    Researchers have disclosed the details of an attack method that can allow a malicious actor to take control of a computer and gain access to sensitive data by connecting a specially crafted device to its Thunderbolt port.

    The attack, dubbed Thunderclap, involves a series of vulnerabilities that can be exploited via Thunderbolt, a hardware interface created by Apple and Intel for connecting peripheral devices to a computer. The security holes were discovered by a team of researchers from Rice University in the United States, University of Cambridge in the United Kingdom, and SRI International.

    The flaws impact a vast majority of the laptops and desktop computers made by Apple since 2011. However, Thunderbolt 3 is often supported via USB Type-C ports, which means that computers designed to run Windows and Linux can be vulnerable as well. The researchers noted that exploitation is also possible through devices connected via PCI Express or chips directly soldered to the targeted computer’s motherboard.

    While launching an attack requires physical access to the targeted system, the experts noted that an attacker can use apparently harmless devices such as chargers of video projectors, which, in addition to launching an attack, can also perform their intended task to avoid raising suspicion.

    The researchers reported their findings to affected vendors back in 2016 and have been working with them ever since to develop patches. Both Apple and Microsoft have rolled out some fixes for macOS (starting with version 10.12.4) and Windows (in Windows 10), but they only address the most dangerous problems discovered by the experts.

    Intel has created patches for the Linux kernel (expected to be released soon) and one unnamed notebook vendor said it would try to address the issues before adding Thunderbolt to its new product lines.

    Thunderclap attacks are mitigated on Windows and some Linux systems due to a Thunderbolt access control mechanism that prompts users when a device is connected, but many people would likely click through these prompts. Furthermore, the researchers pointed out that the access control prompt is not displayed if the attack is carried out via a PCI Express peripheral.

    “In general terms, platforms remain insufficiently defended from peripheral devices over Thunderbolt such that users should not connect devices they do not know the provenance of or do not trust,” the researchers noted.

    The Thunderclap attack leverages the fact that peripheral devices are given direct memory access (DMA), which means they can read from and write to all the system memory without oversight from the operating system.

    The targeted memory can store valuable information, such as passwords, financial information, and browsing data. Attackers could also inject code that would be executed with the highest privileges, giving them complete control over the machine.

    The input-output memory management unit (IOMMU) was designed to provide protection against such attacks by restricting the access of peripherals to memory. However, IOMMU introduces some performance penalties and it’s often disabled by default. On the other hand, the researchers have demonstrated that even if IOMMU is enabled and configured properly, attacks are still possible via the Thunderclap vulnerabilities.

    The researchers have made available technical details for Thunderclap and released an open source platform that can be used by other researchers and vendors interested in testing their products against these types of DMA attacks.

    Back in 2015, a researcher showed how the Thunderbolt port on MacBooks could be abused to install an OS X firmware bootkit.

    Related: MacBooks Leak Disk Encryption Password

    Related: Researcher to Demonstrate Attack on Apple EFI Firmware

    view counter

    Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

    Previous Columns by Eduard Kovacs:
    Tags:





    Source link

    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

    Related Posts

    Hybrid work transition reveals low enterprise cybersecurity confidence

    June 28, 2022 Cyber Security

    Ransomware in Q1 2022 doubled total 2021 volume

    June 28, 2022 Cyber Security

    Lithuania hit by DDoS cyberattack

    June 28, 2022 Cyber Security

    2 out of 3 European citizens welcome digital ID wallet

    June 28, 2022 Cyber Security

    87% of executives have no cybersecurity tools on personal devices

    June 27, 2022 Cyber Security

    CISA releases cloud security reference

    June 27, 2022 Cyber Security
    Editors Picks

    Sony’s InZone gaming monitors and headsets are for more than just PS5 gamers

    June 29, 2022

    Ripple Labs Inc Floats CBDC Innovate Challenge

    June 29, 2022

    Trump-endorsed candidate clinches Republican nomination for Illinois governor

    June 29, 2022

    Pinterest has a new CEO, who has one job: to build the internet’s shopping mall

    June 29, 2022
    Trending Now

    Are Hyper’s stackable USB-C chargers melting?

    By techbizweb

    Finland and Sweden poised to join Nato after Turkey drops veto

    By techbizweb

    Belkin’s MagSafe charging stand can now fast charge the Apple Watch Series 7

    By techbizweb

    https://www.nationalsportsacademy.com

    slot gacor hari ini

    http://www.inadesfo.org/

    http://www.eueomgbissau.org/

    http://www.congo-mai-mai.net/

    http://www.angelesdelafrontera.org/

    http://fifaworldcup2018schedule.com/

    http://tony4gtrmcr.co.uk/

    http://www.standrewsagreement.org/

    http://www.bob-russell.co.uk/

    http://davidmulholland.co.uk/

    http://railwayhotelenniskillen.com/

    http://www.fantasysportstrades.com/

    http://www.rainleaf-flooring.com

    http://mothersagainstguns.org/

    http://ma-coc.org/

    slot online

    http://www.paradoxmag.com/situs-judi-slot-online-gampang-menang-2021/

    http://www.paradoxmag.com/situs-judi-slot-online-terbaru-2021/

    http://slot-terbaru.net/

    Slot Gacor

    Slot Online

    Situs Slot Gacor

    http://www.appdexterity.com/

    https://cars4kids-deutschland.de/

    https://www.stretchingculture.com/

    https://www.b-123-hp.com/slot-gacor/

    https://denzstaffing.nl/

    https://ezbbqcooking.com/slot-gacor/

    https://www.mbahelp24.com/slot-gacor

    https://minhtanstore.com/slot-jackpot-terbesar/

    https://njbpusupplierdiversity.com/slot-gacor-gampang-menang/

    https://www.floridaspecialtycropfoundation.org/slot-gampang-menang/

    https://childrenscornerpreschool.org/slot-gacor-gampang-menang/

    https://cryptoquoter.com/slot-online-terbaik/

    https://alorkantho24.com/slot-gacor/

    https://ellas.xyz/slot-gacor/

    https://it.dougamatome.xyz/slot-online/

    https://www.daltercume.com/slot-gacor/

    https://josi-ana.dougamatome.xyz/slot88/

    https://josi-ana.dougamatome.xyz/slot-gacor/

    https://fastobserver.com/slot-jackpot-terbesar/

    https://www.planetexperts.com/slot-gacor/

    https://bfsolution.group/slot-bet-kecil/

    https://rustleva.co/slot/

    https://bfsolution.group/slot-bet-kecil/

    https://www.hotelcalimareal.com/togel-online/

    https://anime-game.dougamatome.xyz/slot-gacor-gampang-menang/

    https://anime-game.dougamatome.xyz/togel-online/

    https://bourbonbarrelfoods.com/slot/

    http://suneo39.wp.xdomain.jp/slot/

    https://techbizweb.com/slot-gacor/

    https://www.generalcatalyst.com/18-daftar-slot-gacor-terbaik-gampang-menang-jackpot-hari-ini/

    https://www.hotelcalimareal.com/slot-online/

    https://www.blockgates.io/slot-gacor/

    https://l12.com.br/slot-gacor/

    slot paling gacor

    https://www.donalds-hobby.com/slot-online/

    https://thecryptodirt.com/slot-gacor-hari-ini/

    http://iseta.edu.ar/aulavirtual/app/upload/users/1/1205/my_files/sbobet.html

    http://escuelavirtual.mincit.gov.co/app/upload/users/1/194/my_files/slot.html

    https://www.dev.medecinesfax.org/courses/JUDICASINO/document/slot.html

    http://www.e-archivos.org/cursos/courses/JUDICASINO/document/slot-gacor.html

    http://iesma.com.br/ead/main/upload/users/4/447/my_files/slot.html

    https://www.fundacoop.org/chamilo/app/upload/users/1/1185/my_files/slot.html

    https://fata-aatf.org/eskola/main/upload/users/3/31/my_files/slot.html

    https://uancv.edu.pe/ofinvestigacion/app/upload/users/3/328/my_files/slot-terlengkap.html

    https://micost.edu.my/EL/app/upload/users/2/209/my_files/slot-gacor.html

    https://www.academiacoderdojo.ro/elearningdev/app/upload/users/2/2442/my_files/slot-online.html

    http://campus-cidci.ulg.ac.be/courses/JUDICASINO/document/slot-termurah.html

    https://www.escueladerobotica.misiones.gob.ar/aula-ste/courses/LIVECASINO/document/slot-tergacor.html

    http://ccdipeepccqqfar.usac.edu.gt/chamilo/app/upload/users/3/358/my_files/slot-online.html

    https://cunori.edu.gt/campus/app/upload/users/7/7334/my_files/slot-online.html

    http://u-rus.com.ar/aula/app/upload/users/1/1322/my_files/slot.html

    http://icrodarisoveria.edu.it/chamilo/app/upload/users/1/1855/my_files/slot.html

    https://iestpliliagutierrez.edu.pe/clarolgm/courses/CASINO/document/slot.html

    http://pva.cobach.edu.mx/app/upload/users/7/7379/my_files/slot.html

    http://www.imb-pc-online.edu.gt/PL/app/upload/users/3/373/my_files/slot.html

    http://avcs.upeu.edu.pe/main/upload/users/3333/my_files/slot.html

    https://chamilo.fca.uas.edu.mx/app/upload/users/1/11186/my_files/slot-online/

    TechBizWeb
    Facebook Twitter Instagram Pinterest Vimeo YouTube
    • Home
    • Guest Post
    • About Us
    • Privacy Policy
    • Our Authors
    • Terms and Conditions
    • Contact
    © 2022 Tech Biz Web. Developed by Sawah Dev.

    Type above and press Enter to search. Press Esc to cancel.