Thunderbolt: Exposure and Mitigation CS838-1 - Fall 2013 Final Project Report Saul St. John University of Wisconsin - Madison Abstract of a specially-constructed, purpose specific malicious de- vice. The Thunderbolt interface, similarly to its quasi- The contributions of this paper are two-fold: first, we predecessor, FireWire, exposes to external peripherals demonstrate the practicality of this attack using an in- direct access to the system bus. What’s more, Thun- expensive, commonly available Thunderbolt adapter and derbolt exacerbates said previously existing vulnerabil- widely-available software to construct a malicious device ity by exposing additional platform features to connected capable of exploiting a system via the Thunderbolt in- devices. In this paper, we begin by describing and terface. Secondly, we demonstrate that commonly sug- exploring these vulnerabilities. We then discuss mit- gested mitigation tactics are ineffective in the face of this igation tactics against these attacks, both well-known attack. and novel. Subsequently, we consider countermeasures The next section describes the Thunderbolt architec- against these techniques to mitigate a Thunderbolt-borne ture in greater detail, with a focus on the implementation threat. Finally, we discuss the construction of a proto- that exists on Apple MacBook computers. The subse- type of a device that appears to behave maliciously, and quent section discusses a prototype implementation of a show that no mitigation techniques suggested are suffi- malicious Thunderbolt device, and several potential fu- cient to prevent a multi-vector Thunderbolt-born attack ture enhancements to effect persistence and stealth. Next, in the usual case. mitigation tactics are presented and discussed. Finally, those tactics are analyzed, and their effectiveness evalu- 1 Introduction ated. In 2011, Apple and Intel released the first commercially 2 Background available implementation of their new Thunderbolt (ne Light Peak) peripheral device interface. Promoted as There are three key subsystems within a modern personal ”the most advanced I/O ever,” Thunderbolt ”supports computer that are responsible for the broad attack sur- high-resolution displays and high-performance data de- face exposed by the Thunderbolt interface. They are de- vices through a single, compact port.” It is able to ac- scribed herein. complish this feat by virtue of its architectural construc- tion: as a logical extension of the PCIe bus, Thunder- 2.1 Thunderbolt Controller bolt affords peripheral devices the same access to system functionality that any internal PCIe expansion card might Thunderbolt is, fundamentally, a hardware-agnostic se- consume. rial protocol for multiplexing multiple external signals. One of the primary facilities offered by the PCIe bus It achieves hardware-agnosticism by means of requiring architecture is the ability for devices to directly trans- active components in all interconnect cables. It thereby act with system memory, bypassing the CPU, via Direct abstracts itself from the need to define a physical-layer Memory Access (DMA). Through this interface, devices signaling protocol by requiring all interconnect devices might compromise the integrity of a running system or – including simple patch cables – to provide the neces- exfiltrate system data. As such, the Thunderbolt interface sary functionality in order transmit over a given medium. exposes the system to infiltration by malicious individu- Thunderbolt itself does not define the protocols which als with physical access to the machine and in possession it supports multiplexing over its own media– however, 1 at this time, the only known use-cases for Thunderbolt 3.1 DMA attack is transmission of DisplayPort signals and extension of the PCIe bus. As an extension of the PCIe bus, it acts Direct Memory Access is a feature of the PCI bus that as a transparent bridge– to the PCIe Root Complex, a was introduced to lessen the involvement of the sys- Thunderbolt-attached device appears no differently than tem CPU in I/O operations over the system bus. Prior any other PCIe device on a secondary bus. As such, to DMA, the process for transmitting data over the bus a Thunderbolt connected device can invoke all system required the CPU to chunk data to be transmitted into functionality ordinarily allowed to a PCIe bus-connected blocks acceptable for transmission over the bus and for device, such as participation in the system boot process, receipt by the device, and then send each such chunk in- peer-to-peer transactions over the PCI bus, and Direct dividually. On the reverse path, the system must period- Memory Access. ically poll the device for fresh data, and then retrieve it similarly. On a system supporting DMA, devices on the PCIe 2.2 Extensible Firmware Interface bus can be flagged as ’Bus Masters.’ A so-flagged de- vice is allowed to “drive” the system bus– to directly The Extensible Firmware Interface (EFI) is the logical issue read and write commands to system memory, un- successor to the traditional IBM PC architecture’s Ba- solicited. The intention is that the system notifies the sic Input/Output System (BIOS). Unlike BIOS, EFI was device of the memory address where it would like data designed from the ground-up to provide a modern run- to be written to or transmitted from, and the device be- time environment with well-defined and standardized in- comes responsible for satisfying the entirety of the re- terfaces to the system components which participate in quest. However, a malicious device need not so-operate. the boot process. DMA attacks against Apple systems are not unique to those systems with Thunderbolt interfaces; the FireWire interface previously used was also vulnerable to such an 2.3 I/O Memory Management Unit attack. As was shown in previous work, such as Incep- tion [1], this sort of attack can fully compromise a run- An I/O Memory Management Unit (IOMMU) is a de- ning system and exfiltrate arbitrary data. vice akin to a traditional MMU such as might live in the North Bridge of a traditional Intel x86 architecture sys- tem. Rather than translating virtual addresses to phys- 3.2 Option ROM attack ical addresses, however, it offers a CPU-programmable In order to allow devices to participate in the system boot mechanism to facilitate the translation of bus addresses process, the PCI specification defines a mechanism by to physical addresses. On the Intel architecture, where which a device may expose an ’Option ROM’– a memory supported, IOMMU functionality is built into the system device which may extend the functionality of the system Platform Controller Hub, and branded “VT-d.” firmware so as to initialize itself, and provide services to In the Intel architecture, VT-d is positioned as a fea- the platform firmware. Under BIOS systems, this sort of ture for accelerating the I/O performance of hypervisor- facility was utilized to allow add-on graphic devices to hosted virtual machines, as it allows guest virtual ma- display messages from the system during initialization, chines to directly participate in DMA with host devices– and to expose network devices’ ability to provide a sys- the IOMMU, in this case, is programmed so as to trans- tem boot image, such as by PXE. late the addresses of guest-bound DMA to host-physical Under EFI, the Option ROM interface has become addresses. However, it has often been suggested for use much more general. All devices on the PCIe bus may in providing security to systems that expose interfaces expose an Option ROM, and said ROM may contain arbi- allowing DMA through external connectors (such as all trary data. If such data is an EFI driver image appropriate Intel-architecture Apple systems going back at least a for the execution platform, it is loaded into memory and decade.) executed during the EFI boot process’s DXE (Driver eX- ecution Environment) phase. As an EFI driver image dif- fers from an EFI executable image– such as an operating 3 Exposure system bootloader– only by a typecode in the image’s PE header, an EFI driver, when initialized, can perform any The Thunderbolt interface, by virtue of its ability to cou- of the same operations an OS bootloader or a platform ple external devices so closely to the system bus, exposes driver can. In other words, it executes in an unrestricted the system to a pair of attacks, described herein, each of environment with full access to system components. which can result in complete system compromise. As a result, an Option ROM can be used as the 2 launching-point for several types of attack. 3.2.3 EFI runtime services table poisoning The EFI provides a rich set of functionality to images 3.2.1 SMM attack executing in the pre-boot environment, called the Boot Services. Subsequent to system boot, however, those ser- On Intel-architecture systems, the System Management vices are no longer available. Instead, the EFI exposes a Mode (SMM) is a processor state where operating sys- much more limited set of services to an executing op- tem and userland execution is suspended, and platform- erating system, known as the Runtime Services Table. specific code executes to effect platform-specific ends This table contains pointers to firmware-provided exe- (such as power management, its original designed use- cutable code, located in memory and exposing a stan- case.). The code executed in SMM is hidden from in- dardized call-specification, which the operating system spection by the operating system by virtue of being lo- may call to invoke platform services. This interface al- cated at memory-addresses traditionally reserved for the lows the operating system to, for example, access plat- VGA graphics aperture. As this code is “invisible” from form NVRAM; however, it does not offer the rich set of the perspective of an initialized system, it is difficult functionality available to boot services, such as memory to validate or check for malware.