As has been widely reported, vulnerabilities in the Thunderbolt interface have been disclosed by security researchers. “Thunderclap”, as it is known, is a set of vulnerabilities that take advantage of issues with the way Thunderbolt operates and allows a device connecting via the interface to acquire sensitive data from the host Mac, an issue that affects almost all Macs released since 2011, notes AppleInsider.
Thunderclap vulnerabilities let malicious peripherals attack a Mac’s memory. It also affects some Windows, Linux, and FreeBSD systems. Thunderclap affects the way Thunderbolt-based peripherals are allowed to connect and interact with these operating systems, allowing a malicious device to steal data directly from the operating system’s memory.
According to ZDNet, researchers from the University of Cambridge, Rice University, and SRI International discovered the Thunderclap issues back in 2016, and they’ve been working quietly with hardware and operating system versions for three years in complete silence to have them fixed.
Thunderbolt 3 is often supported via USB Type-C ports on modern laptops. Machines with older versions of Thunderbolt (carried over a Mini DisplayPort connector) are also affected. Thunderclap vulnerabilities can also be exploited by compromised PCI Express peripherals, either plug-in cards or chips soldered to the motherboard.
The research team behind the vulnerability says that “all Apple laptops and desktops produced since 2011 are vulnerable, with the exception of the 12-inch MacBook.” They add that “many laptops, and some desktops, designed to run Windows or Linux produced since 2016 are also affected,” if they support the Thunderbolt interface.
It should be noted that Thunderclap requires physical access to the computer. The end of the AppleInsider article states the best advice of not plugging in random and untrusted Thunderbolt devices of any sort into your Mac. You can also protect yourself by not leaving your computer unattended in public and by not using public USB-C charging stations.
Technical details about the Thunderclap flaws are available in a research paper titled “Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals,” available for download in PDF form at thunderclap.io/thunderclap-paper-ndss2019.pdf .
Be sure to check back with the Rocket Yard for more developments on this story.
The OWC Travel Dock provides effective protection from malware while allowing use of public USB-C charging stations.