DMA attacking over USB-C and Thunderbolt 3

I just got an Intel NUC Skull Canyon that has an USB-C port capable of Thunderbolt 3. Thunderbolt is interesting since it's able to carry PCI Express which is Direct Memory Access (DMA) capable. I have previously demonstrated how it is possible to DMA-attack macs over Thunderbolt 2 in my DEF CON talk "Direct Memory Attack the Kernel".

To attack my MacBook Air in the DEF CON demo I used a Sonnet Echo ExpressCard Thunderbolt 2 to ExpressCard adapter together with a PCILeech ExpressCard.

I also got a Thunderbolt 3 to Thunderbolt 2 adapter from Startech and I wanted to try it on the NUC to see if it's possible to use it for DMA attacks, or if Thunderbolt has been secured. The setup looks like this: NUC -> Startech TB3 to TB2 adapter -> Sonnet TB2 to ExpressCard adapter -> PCILeech ExpressCard.

There exists a BIOS setting for the Thunderbolt Security Level. The default setting is Unique ID. The other possible security levels are Legacy Mode, One time saved Key and DP++ only. The Legacy Mode is of special interest when it comes to DMA attacking.
Thunderbolt Security Level in BIOS - Unique ID is the default.

Thunderbolt 3 with Unique ID (Default)
It was not possible to access memory before the OS started - when the computer was still in BIOS/UEFI mode. The PCILeech device wasn't initialized at all.

It was not possible to access memory in Linux. Ubuntu detected that the Sonnet Echo ExpressCard adapter was connected but there was a lot of error messages; probably due to lack of driver support. No driver was installed in this test.
Error messages when connecting the Sonnet Echo ExpressCard adapter to the Startech adapter.

It was not possible to access memory straight out of the box in Windows 10 with the Unique ID Thunderbolt Security Mode. Windows 10 first didn't react at all to the Thunderbolt devices connected. The devices were then disconnected and the proper Thunderbolt drivers from Intel was installed. When the Startech Thunderbolt 3 to Thunderbolt 2 adapter was connected nothing happened at all.

When the Sonnet Echo ExpressCard Thunderbolt 2 to ExpressCard adapter was connected Windows popped up a prompt asking to approve the adapter. Administrative privileges was required to approve the Sonnet Thunderbolt 2 to ExpressCard adapter. It seems like the Thunderbolt 3 to Thunderbolt 2 adapter from Startech is transparent in this setup - while the Sonnet adapter is not. The Sonnet adapter was approved by the logged on administrator.
Approve Thunderbolt Devices administrative box.

After the Sonnect Echo ExpressCard device was approved the PCILeech device was inserted into the Sonnet adapter. Windows did not react at all. The PCILeech device was working. It seems like if the Thunderbolt Security Mode set to Unique ID and do have a Sonnet adapter approved you are at risk for DMA attacks even though the PCILeech may never have been connected to the system previously.

On the other hand if you are just running Windows 10 and never connected a PCI Express adapter, like the Sonnet Echo ExpressCard, you should be secure.

Thunderbolt 3 in Legacy Mode
Just like previously it was not possible to access memory before the OS started - when the computer was still in BIOS/UEFI mode. The PCILeech device wasn't initialized at all.

Dumping memory over Thunderbolt 3 is working perfectly on a locked Ubuntu 16.04 LTS provided that the Thunderbolt Security Level is set to Legacy Mode in the BIOS settings. If Thunderbolt security is set to Legacy Mode just plug in the PCILeech device via the adapters into the Thunderbolt 3 port in the NUC and start dumping. It's as easy as that. No drivers are required on the target system. In the example below the adapters and the PCILeech device was connected to the Linux system for the very first time.
Dumping 32GB memory over USB-C/Thunderbolt 3 on Ubuntu 16.04 LTS.

Accessing the memory of a Windows 10 system also works if the Thunderbolt Security Level is set to Legacy Mode. It is possible to access the memory of a Windows 10 system by just plugging in the adapters and the PCILeech device - no drivers are required on the target system - it just works! There was no need to install the Intel Thunderbolt drivers in order to access the memory.
Windows 10 system shell spawned over Thunderbolt 3.

Other
The setup was incompatible with the other two remaining Thunderbolt Security Levels.

Not all USB-C connectors support Thunderbolt 3. 

Conclusion
The default Thunderbolt security settings are secure - unless you approve a Thunderbolt to PCI Express adapter like the Sonnet Echo ExpressCard.

Also set a BIOS password to prevent an attacker to change into Legacy Mode without you noticing.


Comments

Post a Comment

Popular posts from this blog

Remote LIVE Memory Analysis with The Memory Process File System v2.0

Image
This blog entry aims to give an introduction to The Memory Process File System and show how easy it is to do high-performant memory analysis even from live remote systems over the network. This and much more is presented in my BlueHatIL 2019 talk on February 6th. Connect to a remote system over the network over a kerberos secured connection. Acquire only the live memory you require to do your analysis/forensics - even over medium latency/bandwidth connections. An easy to understand file system user interface combined with continuous background refreshes, made possible by the multi-threaded analysis core, provides an interesting new different way of performing incident response by live memory analysis. The image above shows the user staring MemProcFS.exe with a connection to the remote computer book-test.ad.frizk.net and with the DumpIt live memory acquisition method. it is then possible to analyze live memory simply by clicking around in the file system. Dumping the physical memory
Read more

Total Meltdown?

Image
Did you think Meltdown was bad? Unprivileged applications being able to read kernel memory at speeds possibly as high as megabytes per second was not a good thing. Meet the Windows 7 Meltdown patch from January. It stopped Meltdown but opened up a vulnerability way worse ... It allowed any process to read the complete memory contents at gigabytes per second, oh - it was possible to write to arbitrary memory as well. No fancy exploits were needed. Windows 7 already did the hard work of mapping in the required memory into every running process. Exploitation was just a matter of read and write to already mapped in-process virtual memory. No fancy APIs or syscalls required - just standard read and write! Accessing memory at over 4GB/s, dumping to disk is slower due to disk transfer speeds. How is this possible? In short - the User/Supervisor permission bit was set to User in the PML4 self-referencing entry. This made the page tables available to user mode code in every process. The page t
Read more

Attacking UEFI

Image
Unlike macs  many PCs are likely to be vulnerable to pre-boot Direct Memory Access (DMA) attacks against UEFI. If an attack is successful on a system configured with secure boot - then the chain of trust is broken and secure boot becomes insecure boot. If code execution is gained before the operating system is started further compromise of the not yet loaded operating system may be possible. As an example it may be possible to compromise a Windows 10 system running Virtualization Based Security (VBS) with Device Guard. This have already been researched by Dmytro Oleksiuk . This post will focus on attacking UEFI over DMA and not potential further compromises of the system. What is UEFI? UEFI is short for Unified Extensible Firmware Interface . It is the firmware that is running on the computer before the operating system is booted. UEFI is responsible for detecting memory, disks and other hardware required to boot the operating system. UEFI is a small operating system in itself. It'
Read more