Thunderspy: physical access still matters
A researcher showed how a Thunderbolt port can unlock a laptop in minutes. Encryption and settings decide the damage.
This week a security researcher published Thunderspy: flaws in Thunderbolt that let someone with a few minutes alone with a laptop read its memory and get around the lock screen, even with disk encryption on. It mainly affects computers made before 2019 without a feature called Kernel DMA Protection.
Most of us aren’t targets of a hotel-room attack. But physical access is easy to forget:
- Shut down or hibernate laptops when you leave them somewhere, rather than just locking the screen.
- Use full disk encryption with a PIN at startup on sensitive machines.
- Check Kernel DMA Protection in Windows System Information. Newer laptops have it.
- Update firmware from your laptop maker.
- Disable Thunderbolt in the BIOS on high-risk machines that don’t use it.