Thunderbolt and USB4 ports on locked Windows PCs remain vulnerable to Direct Memory Access (DMA) attacks unless a specific security setting is enabled, according to hardware security researchers. Because these high-speed interfaces bypass the operating system’s CPU to directly read and write system memory, malicious peripherals can extract encryption keys or login credentials in seconds.
How Thunderbolt DMA Exploits Work on Locked PCs
Modern hardware interfaces like Thunderbolt 3, Thunderbolt 4, and USB4 offer massive bandwidth by connecting external devices straight to a computer’s PCI Express (PCIe) root complex. According to security documentation from Microsoft, this direct hardware pathway means a plugged-in device can access physical RAM without CPU intervention. If an attacker plugs a custom hardware device into an unattended, locked PC, they can read sensitive data straight from memory. This technique bypasses standard OS-level login screens and software firewalls entirely because the threat originates at the hardware layer.
The Windows Security Setting That Blocks DMA Threats
To mitigate this risk, Microsoft implemented Kernel DMA Protection in compatible Windows 10 and Windows 11 devices equipped with virtualization-based security (VBS). According to Microsoft’s official security guidance, users must ensure that Kernel DMA Protection is active in system settings and that BIOS configurations restrict external port access. When configured correctly, the operating system blocks unauthenticated Thunderbolt and USB4 peripherals from connecting until the user unlocks the machine. Users can verify their security status by opening the Windows Security app, navigating to Device Security, and checking for Core Isolation and Memory Integrity details.
Verifying Hardware Compatibility for Kernel DMA Protection
Not all computers support full hardware-level DMA defense. According to hardware specifications from Intel and AMD, Kernel DMA Protection requires specific CPU generations—such as Intel 8th-generation chips or newer—along with OEM firmware support enabled at the BIOS level. Users running older motherboards lacking IOMMU (Input-Output Memory Management Unit) virtualization support cannot enable these protections natively. On unsupported systems, the most effective defense remains powering down the machine completely rather than leaving it in Sleep or Hibernate mode when left unattended.
Summary and Recommended Precautions
Physical security for modern laptops requires more than just a strong login password. Because high-speed ports create hardware trust pathways, enabling Kernel DMA Protection in Windows and updating motherboard firmware prevents unauthorized memory extraction. For devices lacking hardware-level support, shutting down the computer entirely remains the safest practice when leaving hardware unattended in public spaces.
Related reading