Hector Martin

I pretty much entirely agree but I also thinkthinl it's useful having constant reminder that Thunderbolt and every other inane "external connection DMA bus" is Intel & friends being reckless with their customers' safety.

Like, there shouldn't be a key that gives you a backdoor to a laptop to begin with, so even if the method by which attacker obtains it is no big surprise, the existence of the key already is.

The key is in *your* already trusted device. It's not some kind of global master key. You need to break into an already trusted device. The right way to stop DMA attacks is with an IOMMU, which is complementary to all this. Proper IOMMU usage blocks all this crap anyway.

IOMMU, or just not having bus mastering. But yeah. Problem is none of their IOMMUs work. They don't fail closed.

Why is that? I haven't looked at how one actually programs an IOMMU. Is it a fundamental limitation or some sort of "we can't break existing devices relying on being able to read/write anywhere"?

AIUI it's disabled by default until the OS enables it, bypassable in various ways, and not supported by lots of drivers so OS ends up turning it partially or fully off...

Also even if a driver uses it, it can use it wrong by sharing memory containing pointers into another memory space (eg kernel memory) that device can then clobber.

Right OS model is not to allow drivers to setup their own IOMMU mappings or DMA buffers, force everything through permanent DMA bounce buffers owned by kernel in fixed ranges.