« first day (3046 days earlier)   

12:36 AM
@jdgregson Yes.
And the malware wouldn't even need to use Thunderbolt if it's connected via PCIe, since PCIe supports DMA natively. Just write to the SSD firmware, which is as easy as using the native DOWNLOAD_MICROCODE ATA command that even hdparm supports.
This of course assumes that the IOMMU is unconfigured or improperly configured.
Whether or not that is the case depends on your operating system (Linux does not isolate by default unless you set intel_iommu=on as a boot parameter, whereas Windows does kinda-sorta enable the IOMMU but not very securely), and the quality of the DMAR tables supplied by your BIOS vendor.
 

« first day (3046 days earlier)