News for hackers. Stuff that matters.

A comment on Don’t plug in that free Microsoft Office USB drive you got in the mail. Parent comment

Re:Don’t plug in that free Microsoft Office USB drive you go... by blep_ on Saturday August 20, 2022 @03:10AM (#32529937)
> Thunderbolt also gets access to the PCIe bus (and also by extension, DMA). I'm not sure what the security situation is there.

There is support for having the user authorize the device before logically connecting it to the rest of the system; see e.g. https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...

It would not surprise me if this does nothing, because firmware implements it poorly, and/or because users click OK on everything.

[ Parent | on HN ]
Re:Don’t plug in that free Microsoft Office USB drive you go... by vetinari on Saturday August 20, 2022 @09:41AM (#32531998)
Device authorization for PCIe tunnels is TB3+ feature, older versions are out of luck.

The situation with firmware is not that bad, though. There are exactly two of them, Intel and Apple. Apple devices have the Apple implementation and the rest of the world Intels.

On capable hardware, IOMMU is also used (for all security levels).

[ Parent | on HN ]