Fatal vulnerabilities in Thunderbolt

[Dutch_Master]

Dutch IT student Björn Ruytenberg discovered a persistent hack for the Thunderbolt eco-system. A well-prepared hacker could gain access to a device via this port within 5 mins.

Complete story here: https://www.tue.nl/en/news/news-overview/10-05-2020-eindhoven-security-researchers-find-fatal-vulnerabilities-in-thunderbolt/

 

A tool was released to investigate whether a port is vulnerable via this link: https://thunderspy.io/

Article on Wired: https://www.wired.com/story/thunderspy-thunderbolt-evil-maid-hacking/

[minibois]

I think this is an important part of the article:

Quote

Ruytenberg found seven vulnerabilities in Intel’s design and developed nine realistic scenarios (collectively known as Thunderspy) for how these could be exploited by a malicious party. Thunderspy does not require any action by the victim, such as inadvertently connecting malicious devices or installing untrusted software.

 

All the attacker needs is five minutes alone with the computer, a screwdriver, and some easily portable hardware. Once they are in, they can read and copy all data, even if the drive is encrypted and the computer is locked or set to sleep. Thunderspy is also stealthy: it leaves no traces of the attack.

[...]

It is also wise not to leave any Thunderbolt-enabled system unattended even just for five minutes.

As far as I read, it requires physical access to your device.

[Dutch_Master]

It does and that may not be applicable for most users, but those who have 'special interest' markers from certain agencies, not necessarily of their own Gov't, are very vulnerable this way. (think journalists, human rights activists, etc)

[SansVarnic]

-= Moved to General Discussion =-

 

@Dutch_Master please update your topic to meet the standard for posting in the Tech News.

When you have, please notify a Mod to have this moved back.

 

Quote

When creating a thread in the News subforum, please make sure your post meets the following criteria:

• Your thread must include some original input to tell the reader why it is relevant to them, and what your personal opinion on the topic is. This needs to be MORE than just a quick, single comment to meet the posting guidelines.
• Your thread must include a link to at least one reputable source. Most of the time, this should be a respected news site.
• Your thread should also include quotes from the cited source(s). While you shouldn't just copy the entire article, your quote should give the reader a summary of the article in a way that gives the key details, but also leaves room for them to read the full article on the linked website. Please use quote tags to show that you have copied this content from another site.
• The title of your thread must be relevant to the topic and should give a reader a good idea of the contents of the thread. Copying the title of the source is permitted but absolutely not required. It should be to the point and not be done in such a way as to mislead a reader, such as clickbait, etc.
• If your article is about a product or some form of media, images are always appreciated, although they are not required.

Failure to comply may result in your thread being locked or removed without warning.

 

[Dutch_Master]

1 minute ago, SansVarnic said:

-= Moved to General Discussion =-

 

@Dutch_Master please update your topic to meet the standard for posting in the Tech News.

When you have, please notify a Mod to have this moved back.

Okay, what's the problem? I don't see why this is suddenly not "Tech News" when Thunderbolt hacks are very much "Tech". The OP has the reputable links, proper title and everything, so now what? Do you want an opinion? Why does one need some-one else's personal opinion when reading Tech News? News is neutral, at least where I live

[SansVarnic]

5 minutes ago, Dutch_Master said:

Okay, what's the problem? I don't see why this is suddenly not "Tech News" when Thunderbolt hacks are very much "Tech". The OP has the reputable links, proper title and everything, so now what? Do you want an opinion? Why does one need some-one else's personal opinion when reading Tech News? News is neutral, at least where I live

I did not say it was not Tech News. Your topic does not meet the standard for posting in the Tech news, please update it and will be moved back. Refer back to my comment and make the appropriate adjustments as outlined in the quote.

[Dutch_Master]

I'm afraid we'd have to agree to disagree then. I don't see any reason why my post should be amended, all the basics are there, the rest is "convenience for the lazy". I'm not buying, sorry.

 

I s'pose some-one else will re-use the links above in his own Tech news post and get the credit for it if it appears in an LMG video. Fine, suit yourselves

[Gegger]

I'll help ya out,

Quote

• Your thread must include some original input to tell the reader why it is relevant to them, and what your personal opinion on the topic is. This needs to be MORE than just a quick, single comment to meet the posting guidelines.
• Your thread should also include quotes from the cited source(s). While you shouldn't just copy the entire article, your quote should give the reader a summary of the article in a way that gives the key details, but also leaves room for them to read the full article on the linked website. Please use quote tags to show that you have copied this content from another site.

yes, I cut parts of it out but that was because you have that stuff already

(sorry mods if this is backseat moderating)

 

as for my opinion, this could be a very big problem for people who travel and use laptops or other devices in public a lot, especially those who aren't tech savvy

[Dutch_Master]

@GeggerThx, but:

1) I don't see adding a personal opinion as an improvement, perhaps (or better: primarily) because I was raised in an environment where news was/is reported neutrally and opinionated reports are very much one of the worst deadly sins for reporting/journalism. I appreciate this is not the case in other nations, including those that claim to be "the g*dd*mn best country in the whole world", but there you go.

2) readers can read the linked articles themselves, I can't do that for them. And there they find the lines I'd quoted, what's the use of that? It's just laziness (sorry, no offense!) and frankly, there's plenty of lazy people on the Web, particularly in forums! I for one have no interest in cultivating more lazy people!

 

But hey, they wanted an opinion! There you have it

[GoodBytes]

2 hours ago, minibois said:

I think this is an important part of the article:

As far as I read, it requires physical access to your device.

The issue is with company laptop or PC tablets  being stolen. Once stolen, the criminal can take its sweet time collecting device information. Now, yes, most criminals steeling a laptop doesn't know shit and doesn't care about the potential lly valuable data or even understands it. But the issue comes in targetted attacks.

[minibois]

6 minutes ago, GoodBytes said:

No. The issue is with company laptop or PC tablets  being stolen. Once stolen, the criminal can take its sweet time collecting device information. Now, yes, most criminals steeling a laptop doesn't know shit and doesn't care about the potential lly valuable data or even understands it. But the issue comes in targetted attacks.

Not sure if you meant to quote me or someone else, but I did not express anything about it not being bad for company laptops. I think this will mostly be an issue for those people.

Like for example, their bag with their laptop is stored in the airplane baggage area (instead of with the users) and someone could receive the info, or the laptop is set somewhere while the user goes to the bathroom.. etc.

[LogicalDrm]

1 hour ago, Dutch_Master said:

I'm afraid we'd have to agree to disagree then. I don't see any reason why my post should be amended, all the basics are there, the rest is "convenience for the lazy". I'm not buying, sorry.

 

I s'pose some-one else will re-use the links above in his own Tech news post and get the credit for it if it appears in an LMG video. Fine, suit yourselves

This is gonna be off topic, but lets address it. The reason why rules are there is simple. We don't want this to become copy-paste hell. By forcing on members to actually read articles they post already roots out rumors and other stuff where original articles aren't that good. It also makes good starting points for discussion to have both your own stand (why did you post this) and the parts of article you find most important/interesting highlighted. The rules have been in place almost since beginning of this forum. Your attitude is therefore really weird. Respect and rewards are earned, not given.

 

If you want to discuss rules, you can make own post about them in https://linustechtips.com/main/forum/81-forum-suggestions/, but I will give you fair warning that your opinion is in minority as there are vocal members who would like more strict guidelines in place.

 

E: Lets add about reporting news since you point that out. You are not reporting news. You are forwarding it from your source to another outlet. You aren't original reporter, but reader who wants others to know about it. In that, you aren't held responsible about any journalistic ethics. Instead, you should be respecting ethics and guidelines of place where you are posting instead.

 

E2: Also funny about "cultivating lazy people". What do you think we try to do with having guidelines in place?

Edited May 11, 2020 by LogicalDrm

[Dutch_Master]

@LogicalDrm OK, fair points. I shall refrain from posting Tech news when I see it first and leave it to others to report instead.

[WkdPaul]

* thread locked *

 

The discussion can be continued in the new thread ;