search

freedomofpress / securedrop-workstation-docs

User documentation for the SecureDrop Workstation
https://workstation.securedrop.org/
GNU Affero General Public License v3.0
5 stars 4 forks source link

Clarify impact of BIOS recommendations on USB-C operation #32

Closed eloquence closed 4 years ago

eloquence commented 4 years ago

As noted in https://github.com/freedomofpress/securedrop-workstation-docs/pull/31#pullrequestreview-394156253 our current BIOS recommendations may interfere with USB-C operation, which seems potentially disruptive of normal use cases. Let's discuss the security benefits of this recommendation in the context of our threat model.

eloquence commented 4 years ago

I'm guessing that the specific recommendation that's causing trouble is:

Disable Thunderbolt ports, or any other ports that allow Direct Memory Access (DMA).

If so, why is this recommendation important? Is it critical that we preserve it? What is its impact on USB-C operation?

emkll commented 4 years ago

I would strongly recommend we preserve that recommendation. Thunderbolt devices connected to the VM can introspect and modify RAM on the host. You can see https://github.com/carmaa/inception for examples of what can be done with these types of attacks. Some operating systems have mitigations in place, but disabling this feature at a firmware level provides strong assurances the likelihood of attacks is either significantly reduced or completely eliminated.

A search in the Qubes issues repo suggests that even with Thunderbolt enabled in the BIOS, Thunderbolt/USB-C ports will not work in Qubes : https://github.com/QubesOS/qubes-issues/issues/5522 . It seems like we should update the documentation to not only recommend, but require the use of USB type A drives.

eloquence commented 4 years ago

Thanks @emkll; it seems problematic to me if an emerging new standard is unavailable to our users in the long run, but given the security risks and lack of Qubes support it looks like there's no way around the USB type A requirement.

Based on a cursory investigation of what's available on Amazon and CDW, it looks like most USB-C flash drives currently on the market are "2 in 1" -- you can use either connector. I'm going to order one of those for testing.

eloquence commented 4 years ago

A search in the Qubes issues repo suggests that even with Thunderbolt enabled in the BIOS, Thunderbolt/USB-C ports will not work in Qubes

Hm, on a closer read this may be more of an issue with PCI hotplug; I'm able to browse files on my Android device via USB-C cable plugged into USB-C/Thunderbolt port on T480 just fine in Qubes (I've not changed BIOS defaults), and @rmol confirms successful use of a YubiKey with USB-C in Qubes.

eloquence commented 4 years ago

I tested disabling Thunderbolt in the BIOS of my T480 (the docs don't specify what to do; here's what I did: "Security -> IO Port access -> Thunderbolt(TM) 3 -> Disabled"). Qubes now no longer starts sys-usb at all, manual attempts to start it fail with Domain sys-usb has failed to start: PCI device dom0:3c_00.00 does not exist.

Is that because I changed the BIOS settings after the install? I'm curious what exact behavior others observe when changing the BIOS settings before the install. Do USB-C devices not get recognized anymore? Fail to attach?

conorsch commented 4 years ago

Is that because I changed the BIOS settings after the install?

Yes! During installation, Qubes enumerated USB & some PCI-E devices and persistently attached those to sys-usb. You can still recover: run qvm-pci in dom0, find the problematic device (the thunderbolt once), and run qvm-pci detach sys-usb <device>. Then you're good going forward.

Do USB-C devices not get recognized anymore? Fail to attach?

More testing required, although several folks are reporting USB-C will continue to work.

(the docs don't specify what to do; here's what I did: "Security -> IO Port access -> Thunderbolt(TM) 3 -> Disabled").

Hmm, good point. There are actually two places in the BIOS where Thunderbolt can be marked as "Disabled" iirc.

eloquence commented 4 years ago

You can still recover: run qvm-pci in dom0, find the problematic device (the thunderbolt once), and run qvm-pci detach sys-usb . Then you're good going forward.

qvm-pci did not list it for me, but I could detach it by specifying the ID from the error message. sys-usb now runs again, but the USB-C/Thunderbolt port does no longer appear to work (USB-A ports do; my T480 doesn't have any other USB-C ones to test with).

More testing required, although several folks are reporting USB-C will continue to work.

Open questions from my perspective:

If our BIOS recommendation has narrow impact just on use of the dual Thunderbolt/USB-C port, then I think we can live with it for some time, but should IMO re-evaluate regularly.

eloquence commented 4 years ago

Good news, everyone! With our BIOS settings, at least on the current T480, it turns out that you can use USB-C devices in the port that you'd ordinarily plug your power adapter into. Just plug the power adapter into the Thunderbolt port instead -- it'll still supply power just fine, even if Thunderbolt is disabled (it even has a little power LED).

Did some additional testing:

Long term, I do think we should aim to continue to have a laptop recommendation that enables users to use USB-C without adapters, because these devices are becoming increasingly common, especially for hubs (see the selection of USB hubs on Amazon, for example).

conorsch commented 4 years ago

You can see https://github.com/carmaa/inception for examples of what can be done with these types of attacks.

See also the more recent https://thunderspy.io/