The Thunderclap vulnerabilities

Nothing new with DMA being dangerous (and also useful of debugging). However we're in 2019 and I think providing unrestricted DMA to external device should not be acceptable.

What constitute an external or internal interface might not be obvious for some attack. For example the SATA port on my ThinkPad UltraBay is quite accessible. Disabling FireWire and other unused port in the BIOS is something I've been doing for a long time.

But a USB Type-C connector is something everyone will be using. Considering Thunderbolt 3 will become USB4, it is a real concern. And just telling user to not plug in "untrusted device" is not good enough.

And my understanding is that this can not be fully fixed at the OS level:

"Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot."
Ref: https://docs.microsoft.com/en-us/windows/security/informa...