bjornruytenberg/spycheck-linux

Verify whether your Thunderbolt-enabled Linux system is vulnerable to the Thunderspy attacks.

spycheck-linux's Issues

Spycheck should detect Thunderbolt controller regardless of the availability of the lightening port designation mark

Spycheck wrongly indicate that the product is not vulnerable when the port is sans-thunderbolt-mark.

$ sudo python3 ./spycheck.py 
Welcome to Spycheck. This tool will verify whether your system is vulnerable to the Thunderspy attacks.

Please identify the ports on your system.
Does your system provide any USB-C or Mini-DP ports? [y/n] y
Is there a lightning symbol printed alongside any of these ports? [y/n] n

Summary:
 System is Not Vulnerable

Your system does not have any Thunderbolt ports and is therefore not affected by Thunderspy.

OS version:
 Linux kernel 5.3.0-18-generic
Kernel DMA Protection:
 Enabled
System vendor: 
 CJSCOPE INC.
Product name: 
 MZ Series


User has indicated system does not provide any Thunderbolt ports. Skipping enumerating Thunderbolt controllers.

$ sudo python3 ./spycheck.py 
Welcome to Spycheck. This tool will verify whether your system is vulnerable to the Thunderspy attacks.

Please identify the ports on your system.
Does your system provide any USB-C or Mini-DP ports? [y/n] y
Is there a lightning symbol printed alongside any of these ports? [y/n] y
Enumerating, please wait...


Summary:
 System is Partially Vulnerable

Your system features a Thunderbolt 3 controller.

Your system supports Kernel DMA Protection, whichpartially mitigates Thunderspy.

For recommendations on how to further protect your system, please refer to https://thunderspy.io/#kernel-dma-protection
Please note that the extent to which your system is partially vulnerable may change as research progresses.

OS version:
 Linux kernel 5.3.0-18-generic
Kernel DMA Protection:
 Enabled
System vendor: 
 CJSCOPE INC.
Product name: 
 MZ Series


Thunderbolt controller #0: 
JHL7540 Thunderbolt 3 NHI [Titan Ridge 2C 2018]
  Generation:
   Thunderbolt 3
  Port number:
   1

USBGuard A Mitigation?

Does using USBGuard prevent an attacker from performing the exploit?

Spycheck on Windows 7 x64 strange results

It says that I do not have TB ports.

I have installed driver and enabled power state.

But it still says I do not have port even if now I can see it in TB tool.

What's the status of pre-kDMAp IOMMU-enabled systems?

Please document somewhere the protection status of systems that are pre-2019 and don't have the opt-in flag in the DMAR table, but do have an enabled IOMMU. Are they still "fully vulnerable", or are they only partially vulnerable (during boot/suspend/resume or something like that)?