What you need to know
- Microsoft explains how Secured-core PCs mitigate attacks like Thunderspy in a new post.
- Thunderspy utilizes the Thunderbolt port to affect direct access memory.
- Secure-cored PCs have Kernel direct access memory protection to protect from Thunderspy and similar attacks.
Microsoft explains how Secured-core PCs help prevent attacks like Thunderspy from being able to access PCs in a new post (opens in new tab). Thunderspy was recently revealed by a team of researchers at Eindhoven University of Technology. The attack method utilizes the Thunderbolt port to gain access to a device's memory. It requires physical access to a device, but it can work even if a device is locked and has hard disk encryption.
Microsoft provides a breakdown of how Thunderspy works to give context to the attack and how Secured-core PCs combat it. In short, an attacker uses a serial peripheral interface flash programmer through a devices Thunderbolt connection. This step gives an attacker access to the PC's Thunderbolt controller firmware. The attacker can then copy and patch the Thunderbolt controller firmware and put the patched version back onto the device. The end result is that an attacker gains access to a device and its data without needing a password.
Secured-core PCs support Kernel direct access memory protection. This type of protection relies on the Input/output Memory Management Unit, allowing it to block external peripherals from gaining altering direct access memory unless a device is signed in and the screen is unlocked. A video from Microsoft Ignite 2019 explains this in more detail.
While these protections don't make a device impenetrable, they do greatly reduce the ease of attacks, according to Microsoft. Microsoft explains in the post:
Secured-core PCs also have hypervisor protected code integrity, which ensures that kernel code cannot be writable and executable.
While these protections make it more difficult for an attacker to gain access to a device, nothing makes a device completely impervious to attacks. Microsoft wisely uses words like "mitigate" rather than "eliminate" when referring to lowering risk factors. On a related note leaked video recently showed that Microsoft's Surface devices don't have Thunderbolt ports due to security concerns.
Sean Endicott is the news writer for Windows Central. If it runs Windows, is made by Microsoft, or has anything to do with either, he's on it. Sean's been with Windows Central since 2017 and is also our resident app expert. If you have a news tip or an app to review, hit him up at firstname.lastname@example.org.
Get the best of Windows Central in in your inbox, every day!
Thank you for signing up to Windows Central. You will receive a verification email shortly.
There was a problem. Please refresh the page and try again.