Posts

Showing posts from October, 2016

DMA attacking over USB-C and Thunderbolt 3

Image
I just got an Intel NUC Skull Canyon that has an USB-C port capable of Thunderbolt 3. Thunderbolt is interesting since it's able to carry PCI Express which is Direct Memory Access (DMA) capable. I have previously demonstrated how it is possible to DMA-attack macs over Thunderbolt 2 in my DEF CON talk "Direct Memory Attack the Kernel". To attack my MacBook Air in the DEF CON demo I used a Sonnet Echo ExpressCard Thunderbolt 2 to ExpressCard adapter together with a PCILeech ExpressCard. I also got a Thunderbolt 3 to Thunderbolt 2 adapter from Startech and I wanted to try it on the NUC to see if it's possible to use it for DMA attacks, or if Thunderbolt has been secured. The setup looks like this: NUC ->  Startech TB3 to TB2 adapter ->  Sonnet TB2 to ExpressCard adapter ->  PCILeech ExpressCard. There exists a BIOS setting for the Thunderbolt Security Level. The default setting is Unique ID . The other possible security levels are Legacy Mode , One time saved Ke