Apple Mac machines with Thunderbolt 3 include: iMac Pro, iMac 2017, Mac Mini 2018, MacBook Pro 2016 onwards, MacBook Air 2018. Although Thunderbolt has initially had poor hardware support outside of Apple devices and has been relegated to a niche gadget port, the adoption of the Thunderbolt 3 using USB-C connector standard into a wide array of hardware bodes well for market acceptance of the standard, besides that it will become part of USB4 standard. Thunderbolt — like many high-speed expansion buses, including PCI Express, PC Card, ExpressCard, FireWire, PCI, and PCI-X — is potentially vulnerable to a direct memory access (DMA) attack. If users extend the PCI Express bus (the most common high-speed expansion bus in systems ) with Thunderbolt, it allows very low-level access to the computer. An attacker could physically attach a malicious device, which, through its direct and unimpeded access to system memory and other devices, would be able to bypass almost all security measures of the operating system, allowing the attacker to read and write system memory, potentially exposing encryption keys or installing malware. Such attacks have been demonstrated, modifying inexpensive commodity Thunderbolt hardware. An IOMMU, if present, bug-free, and correctly integrated into and configured by the operating system, can close a computer's vulnerability to DMA attacks, but only if a malicious device can't alter the code that configures the IOMMU before the code is executed. As of 2019, the major OS vendors had not taken into account the variety of ways in which a malicious device could take advantage of complex interactions between multiple emulated peripherals, exposing subtle bugs and vulnerabilities. Some UEFI implementations offer Kernel DMA Protection. This vulnerability is not present when Thunderbolt is used as a system interconnection ( supported on OS X Mavericks), because the IP implementation runs on the underlying Thunderbolt low-latency packet-switching fabric, and the PCI Express protocol is not present on the cable. That means that if IPoTB networking is used between a group of computers, there is no threat of such DMA attack between them. When a system with Thunderbolt boots, it loads and executes Option ROMs from attached devices. A malicious Option ROM can allow malware to execute before an operating system is started. It can then invade the kernel, log keystrokes, or steal encryption keys. The ease of connecting Thunderbolt devices to portable computers makes them ideal for evil-maid attacks. Some systems load Option ROMs during firmware updates, allowing the malware in a Thunderbolt device's Option ROM to potentially overwrite the SPI flash ROM containing the system's boot firmware.