Thunderspy PoC demo 1: Unlocking Windows PC in 5 minutes
Channel: Thunderspy
Date: 2020-05-11

Thunderspy - When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security
More information: https://thunderspy.io


This video demonstrates an attack exploiting Thunderspy vulnerability variant 5, "Use of unauthenticated controller configurations".


In UEFI, users may choose to employ a Security Level different to the default value (SL1, "User").  In storing Security Level state, we have determined that  Thunderbolt employs two state machines,  with one instance being present in UEFI, and another residing in host controller firmware.  However, we have found firmware configuration authenticity is not verified atboot time, upon resuming from sleep, or at any later point. In addition, we have found these states machines may be subjected to desynchronization, with controller  firmware  overriding  UEFI  state  without  being  reflected in the latter. As such,  this vulnerability subjects the Thunderbolt host controller to unauthenticated, covert overriding of Security Levels configuration.