https://www.techpowerup.com/229594/i...to-usb-exploit

Researchers at Positive Technologies have released information which brings to light vulnerabilities on Intel's U-Series Skylake and Kaby Lake series processors' handling of USB 3.0-based debugging - which could be used to attack, corrupt, and even subvert a user's system.

This vulnerability allows attackers to bypass typical security mechanisms - both at the hardware and at the OS level - by using a debugging interface exploit, which could allow them to install malware and/or rewrite the system's firmware and BIOS. This exploit is currently undetectable using existing security tools, and according to the researchers, this mechanism can be used on a hacked system regardless of the OS installed.
Before Skylake, this was done through a special device that connected to the motherboard's debugging port (ITP-XDP). It was not easily accessible, though - not everyone carries the relevant connections in order to access that kind of ports - so there was not much concern regarding the scale and impact of the attacks (if you recall, typical risk measurement considers both the severity of an exploit's effect as well as the probability of that exploit being explored). That changed when Skylake came out, which introduced the Direct Connect Interface (DCI) that provides access to the JTAG debugging interface through standard USB 3.0 ports - which are much more ubiquitous and easily accessible.

There are no hardware or software tricks needed for an attacker to exploit this, all that is required is that the DCI interface is enabled. On many systems, DCI is enabled by default. On those that are not, there are several ways to enable it. The researchers have already reported this vulnerability to Intel, though at this time there is no fix available. The fact that any individual with malicious intent needs to have physical access to the machine and its USB 3.0 ports makes this exploit a little more difficult to accomplish, but it would seem that workplaces or servers are particularly vulnerable.