Funderbolt: Adventures in Thunderbolt DMA Attacks

Presented at Black Hat USA 2013, Aug. 1, 2013, 2:15 p.m. (60 minutes).

Intel's Thunderbolt allows for high-speed data transfers for a variety of peripherals including high-resolution high-bandwidth graphics displays, all using the same physical connection. This convenience comes at a bit of a cost: an external port into your computer's bus and possibly memory! Thunderbolt ports appear on high-end laptops like the MacBook Pro, but also increasingly on PC hardware, and on newer desktop and server motherboards. This proprietary technology is undocumented but problems with it could potentially undermine the privacy and security of users.

This talk chronicles process of exploring these risks through a practical exercise in reverse engineering. Experience the tribulations with reversing Thunderbolt chips, understand the attack strategies for exploiting DMA and see the pitfalls one encounters along the way, while gaining a deeper understanding of the risks of this new feature.


Presenters:

  • Russ Sevinsky - iSEC Partners
    Russ Sevinsky is a security researcher/consultant at iSEC Partners, an information security firm specializing in application, network, and mobile security. At iSEC, Russ specializes in hardware reverse engineering, web application/web services security, network security/red-team testing, and client/server testing.

Links:

Similar Presentations: