A DMA attack is the exploitation of a computer’s ports to access sensitive data. When an external device plugs into a computer, it connects using direct hardware access to read or write directly to main memory without any operating system supervision or interaction. OS security policies are bypassed, allowing the connected device to directly read or write sensitive data, presenting an opportunity for a DMA attack. If your computer has such a port (e.g., Thunderbolt port), an attacker who gets brief physical access to it can read and copy all your data, even if your drive is encrypted and your computer is locked or set to sleep. DMA attacks so far have required physical access to a computer to launch a successful attack (e.g., Thunderclap, Thunderspy). In this talk, we present a new class of DMA attack, i.e., Ghost DMA attack, that does not require physical access to the computer. Attack is launched by malicious 3rd party apps/FW (malware) that run on platform integrated HW subsystems (PCIe endpoints) by manipulating/programming the subsystem’s DMA Engine to perform arbitrary accesses to host physical addresses space, bypassing OS security policies. We will present a demo to show Ghost DMA attack in action.