Hector Martin

The Thunderbolt attacks, ELI5 version Attack 1: if you break into my house, you can change my lock so it accepts a master key so you can come in later. Attack 2: if you break into my friend's house, and he has my keys, you can copy them and go into my house. Duh?

I pretty much entirely agree but I also thinkthinl it's useful having constant reminder that Thunderbolt and every other inane "external connection DMA bus" is Intel & friends being reckless with their customers' safety.

Like, there shouldn't be a key that gives you a backdoor to a laptop to begin with, so even if the method by which attacker obtains it is no big surprise, the existence of the key already is.

The key is in *your* already trusted device. It's not some kind of global master key. You need to break into an already trusted device. The right way to stop DMA attacks is with an IOMMU, which is complementary to all this. Proper IOMMU usage blocks all this crap anyway.

IOMMU, or just not having bus mastering. But yeah. Problem is none of their IOMMUs work. They don't fail closed.

Why is that? I haven't looked at how one actually programs an IOMMU. Is it a fundamental limitation or some sort of "we can't break existing devices relying on being able to read/write anywhere"?

AIUI it's disabled by default until the OS enables it, bypassable in various ways, and not supported by lots of drivers so OS ends up turning it partially or fully off...