DMA attacks and crypto wallets: what the IOMMU is really guarding.

The aha: a hot wallet’s keys live in RAM, and RAM is on the bus

DMA is a feature, not a bug. Microsoft describes PCIe hot-plug devices such as Thunderbolt, USB4 and CFexpress peripherals as DMA-capable: they read and write system memory without the processor’s involvement. It’s how GPUs, NVMe drives and network cards get their speed. Microsoft: Kernel DMA Protection. The glossary entry on DMA has the short version.

Now look at a hot wallet. Encryption protects the wallet file at rest, but signing needs a usable key. Bitcoin Core’s walletpassphrase command, for example, stores the wallet decryption key in memory for a timeout you choose. Bitcoin developer reference: walletpassphrase. While it’s there, it is a pattern of bytes in RAM like any other.

Here is what changes how you see your PC. Without an IOMMU in the way, a device allowed to master the bus can address any physical memory. The IOMMU turns “any” into “only what its driver mapped”. With it enforcing, the kernel’s Thunderbolt guide says connected devices can’t access memory outside what their drivers allocated. Linux kernel: USB4 and Thunderbolt security levels and IOMMU DMA protection. The IOMMU glossary entry explains the translation.

How a DMA attack works, at a high level

The attacker needs a device that can master the PCIe bus and a way to connect it. External ports such as Thunderbolt and USB4 make that a plug-in job; internal slots and M.2 sockets need the case open. Microsoft calls the plug-in version a “drive-by DMA attack”: the owner steps away, and off-the-shelf tools need only minutes. Microsoft: Kernel DMA Protection.

Researchers have studied this attack class for years. PCILeech, a well-known open-source research tool, uses FPGA-based PCIe hardware to demonstrate DMA access to memory. We won’t cover how it’s used. The academic Thunderclap work (NDSS 2019) went further. It showed that even with an IOMMU, malicious peripherals such as USB-C chargers or projectors could abuse the memory an operating system shares with devices. The authors demonstrated attacks on macOS, FreeBSD and Linux, noted that Windows used the IOMMU only in limited cases, and worked with vendors on mitigations. Markettos et al., “Thunderclap: Exploring Vulnerabilities in Operating System IOMMU Protection via DMA from Untrustworthy Peripherals”, NDSS 2019.

Two lessons for wallet owners. First, DMA needs physical access or a peripheral you plug in; remote attackers use malware and phishing instead, so DMA defences don’t replace the basics. Second, an IOMMU is necessary, but how the operating system uses it matters too, so keep both firmware and OS updated.

Who is actually at risk?

A plain USB device doesn’t perform DMA itself; Microsoft notes that non-PCI peripherals such as USB devices don’t. The risk on a USB-C port comes from PCIe tunnelled through Thunderbolt or USB4. Microsoft: Kernel DMA Protection.

Hot wallet, hardware wallet or cold wallet: where does the key live?

BIP 174 defines a transaction format that lets offline signers, including air-gapped and hardware wallets, sign without direct access to the online computer’s data. The online PC prepares, the device signs, and the key stays put. BIP 174: Partially Signed Bitcoin Transaction format.

A hardware wallet doesn’t make the PC trustworthy. Malware or a malicious device could still change the transaction you’re asked to approve. That’s why you check the amount and address on the hardware wallet’s own screen, not the PC’s.

How to check IOMMU DMA protection on Linux

These commands only read state. Run them on the machine that holds your wallet.

1. Is DMA remapping active?

   sudo dmesg | grep -i -e DMAR -e AMD-Vi -e iommu

   The kernel’s x86 IOMMU guide gives example markers: PCI-DMA: Using DMAR IOMMU on Intel systems and iommu: Default domain type: Translated on AMD. Linux kernel: x86 IOMMU support. No IOMMU lines at all usually means it’s off in firmware or in the kernel.

2. Did the kernel register an IOMMU?

   ls /sys/class/iommu/

   One or more entries, such as dmar0 or ivhd0, mean IOMMU hardware is registered. An empty directory means it isn’t.

3. Is Thunderbolt or USB4 protected by the IOMMU?

   cat /sys/bus/thunderbolt/devices/domain0/iommu_dma_protection
   cat /sys/bus/thunderbolt/devices/domain0/security

   1 in the first file means the platform supports IOMMU-based DMA protection. The second shows the security level: user and secure require approval for new devices, dponly and usbonly limit PCIe tunnelling, and none connects everything automatically. Linux kernel: USB4 and Thunderbolt security levels and IOMMU DMA protection.

4. Has anyone traded protection for speed?

   cat /proc/cmdline

   iommu=pt or iommu.passthrough=1 lets internal devices use untranslated DMA, a common tweak in passthrough guides. intel_iommu=off or amd_iommu=off turns remapping off. On a machine that holds keys, make that trade knowingly.

5. Which devices can the IOMMU tell apart?

   Paste your group listing into the IOMMU group checker. Devices that share a group can’t be fully isolated from each other by the IOMMU; IOMMU groups explained covers why.

How to check Kernel DMA Protection on Windows

Open Windows Security → Device security → Core isolation details → Memory access protection, or run msinfo32 and look for Kernel DMA Protection: On. Microsoft: Kernel DMA Protection.

If it’s Off and Hyper-V – Virtualization Enabled in Firmware says No, Microsoft’s guidance is to turn on Intel Virtualization Technology and VT-d in the UEFI settings and reboot. AMD firmware names the equivalents differently, often SVM and IOMMU. If it stays Off after that, the system doesn’t support the feature.

What it does: external peripherals whose drivers support DMA remapping start normally and are confined to their assigned memory. Peripherals with incompatible drivers are blocked from starting until a user signs in or unlocks the screen. What it doesn’t do: protect during boot, which Microsoft leaves to the firmware, or cover FireWire, PCMCIA, CardBus or ExpressCard.

An external GPU enclosure that won’t start could be this protection doing its job; Thunderbolt eGPU troubleshooting covers authorization and the PCIe path.

Annotated example: a protected Linux laptop (synthetic)

This output is synthetic and trimmed. It shows what “protected” looks like, not a capture from a specific laptop.

# SYNTHETIC
$ sudo dmesg | grep -i -e DMAR -e iommu
[    0.081234] DMAR: Host address width 39
[    0.512345] iommu: Default domain type: Translated
[    0.734567] DMAR: Intel(R) Virtualization Technology for Directed I/O
$ ls /sys/class/iommu/
dmar0  dmar1
$ cat /sys/bus/thunderbolt/devices/domain0/iommu_dma_protection
1
$ cat /sys/bus/thunderbolt/devices/domain0/security
user
$ cat /proc/cmdline
BOOT_IMAGE=/vmlinuz root=UUID=<id> ro quiet splash

• Default domain type: Translated: devices get IOMMU-translated DMA, not passthrough.
• dmar0 dmar1: the kernel registered remapping hardware.
• iommu_dma_protection is 1: Thunderbolt and USB4 devices are confined by the IOMMU. The kernel notes that security levels become redundant in this mode.
• security is user: new devices still need approval, a second gate.
• No iommu=pt or =off on the command line: nobody traded protection for speed.

A weaker setup would show Default domain type: Passthrough, an empty /sys/class/iommu/, iommu_dma_protection set to 0 or security set to none. Each one opens a different gate.

Defensive checklist for crypto wallets on a PC

1. Turn on the IOMMU (Intel VT-d or AMD-Vi) in firmware, and confirm it with the checks above. Intel: Virtualization Technology for Directed I/O (VT-d) specification, AMD: I/O Virtualization Technology (IOMMU) specification, publication 48882.
2. Confirm DMA protection: Kernel DMA Protection On in Windows, or iommu_dma_protection = 1 on Linux.
3. Without IOMMU protection, gate Thunderbolt: keep the security level at user or secure, or use dponly or usbonly if you don’t need PCIe devices on that port.
4. Protect boot: set a firmware password, and turn off Thunderbolt or external-device boot support if you don’t use it. OS-level DMA protection starts with the OS.
5. Shut down, don’t sleep, a machine with an unlocked wallet when you leave it. Sleep keeps RAM, and the key, powered.
6. Keep the hot wallet locked: use short unlock timeouts and lock it again after signing (Bitcoin Core has walletlock).
7. Sign with a hardware wallet for amounts you can’t afford to lose, and verify the address on the device’s own screen.
8. Update OS and firmware, and don’t plug unknown docks, chargers or displays into a machine that holds keys.

Questions

What is a DMA attack?

A DMA attack uses a device that can master the PCIe bus, such as a Thunderbolt peripheral or an internal card, to read or write system memory directly, without the CPU. It usually needs physical access or a malicious device you plug in. An enforcing IOMMU limits each device to the memory its driver mapped.

Can a Thunderbolt or USB-C device steal crypto wallet keys?

A malicious PCIe device on a Thunderbolt or USB4 port could, in principle, read memory holding an unlocked hot wallet’s key if DMA protection is off. A plain USB device doesn’t perform DMA itself. With the IOMMU enforcing and Kernel DMA Protection or Linux Thunderbolt IOMMU protection active, external devices are confined to memory their drivers mapped.

Does Kernel DMA Protection stop PCILeech-style attacks?

It is designed against drive-by DMA from external hot-plug PCIe ports once Windows has loaded: incompatible devices are blocked until a user signs in, and remapping-capable devices are confined to their memory. It doesn’t protect during boot, which is the firmware’s job, and Microsoft describes it as protection against external peripherals.

Is a hardware wallet safe from DMA attacks?

The private key stays inside the hardware wallet and never enters host RAM, so a DMA read of the PC’s memory can’t copy it. The PC still handles the unsigned transaction, so verify the amount and address on the device’s own screen before approving.

Is the IOMMU enough on its own?

It is necessary but not always sufficient. The Thunderclap research (NDSS 2019) showed that malicious peripherals could abuse memory that operating systems deliberately share with devices, even with an IOMMU on. Vendors shipped mitigations, so keep the OS and firmware updated as well.

How do I check if the IOMMU is enabled on Linux?

Run sudo dmesg | grep -i -e DMAR -e AMD-Vi -e iommu and ls /sys/class/iommu/. For Thunderbolt or USB4, cat /sys/bus/thunderbolt/devices/domain0/iommu_dma_protection returns 1 when IOMMU DMA protection is supported.