Apple’s new line of MacBook Pro laptops released yesterday (Feb. 24) comes with Thunderbolt, an advanced data port that, according to one security expert, could also serve as a gaping hole for hackers.
In appearance and function, a Thunderbolt port — a high-speed interface for connecting external devices such as hard drives, video cameras or display monitors — is similar to a USB port.
With regards to security, however, that’s where the likenesses stop, Robert Graham, CEO of security firm Errata Security, wrote on a company blog.
“Imagine that you are at a conference,” Graham said. “You innocently attach your DisplayPort to a projector to show your presentation on the big screen. Unknown to you, while giving your presentation, the projector is downloading the entire contents of your hard disk.”
That scenario is very possible, Graham explains. It has to do with give-and-take and trust — necessary for any healthy human relationship, but dangerous to any partnership between device and computer.
USB ports employ a “master-slave” design — the computer has full access to the external device but the device only has limited access to the computer.
In contrast, Thunderbolt — developed by Intel with help from Apple — employs peer-to-peer functionality, meaning the device attached through the Thunderbolt port has full, unrestricted access to its host, and is configured to automatically trust any device connected to it.
The small difference has a dangerous implication for new MacBook Pro owners.
“A hacker can walk up to your laptop while you are not looking, connect a device for a few seconds, disconnect it and walk away with your data (such as passwords),” Graham wrote.
