Systems that are left in the Standby power state This article applies to any of the following systems: Note that Thunderbolt 3 on the new USB Type-C connector includes new security features which can be configured to protect against this type of attack without disabling the port. Alternatively, an active Thunderbolt port also provides access to system memory to perform an attack. In these configurations, an attacker may be able to search for BitLocker encryption keys in system memory by spoofing the SBP-2 hardware ID by using an attacking device that is plugged into a 1394 port. Therefore, an attacker may be able to perform DMA attacks. This includes when the desktop is locked.īitLocker with TPM-only authentication allows for a computer to enter the power-on state without any pre-boot authentication. Step-By-Step Guide to Controlling Device Installation Using Group PolicyĪ BitLocker-protected computer may be vulnerable to Direct Memory Access (DMA) attacks when the computer is turned on or is in the Standby power state. Microsoft does not guarantee the accuracy of this third-party contact information.įor more information about how to do this, go to the following Microsoft website: This contact information may change without notice.

Microsoft provides third-party contact information to help you find technical support. Please refer to BitLocker Countermeasures to understand the spectrum of mitigations.Īlso users may refer to Intel Thunderbolt 3 and Security on Microsoft Windows 10 Operating System documentation for alternative mitigations. Less Noticeįor Windows version 1803 and later versions, if your platform supports the new Kernel DMA Protection feature, we recommend that you leverage that feature to mitigate Thunderbolt DMA attacks. For earlier versions of Windowsor platforms that lack the new Kernel DMA Protection feature, if your organization allows for TPM-only protectors or supports computers in sleep mode, the following is one DMA mitigation option. Windows Server version 1803 Windows 10, version 1803, all editions Windows Server 2016 Version 1709 Windows 10, version 1709, all editions Windows 10, version 1703, all editions Windows Server 2016, all editions Windows 10, version 1607, all editions Windows 10 Windows Server 2012 R2 Windows RT 8.1 Windows 8.1 Windows Server 2012 Windows 8 More.

Thunderbolt for windows 10