> What are Dell recommendations on this matter ...?

Probably "don't let anyone disassemble your laptop, install a SPI ROM chip, then put it back together"?

@syrenity  in addition to my reply above, in terms of "Dell's recommendations", given that this story just broke yesterday, it's probably not realistic to expect any official response to this yet.  And what would you expect Dell to say at this stage?  This relates to a controller developed entirely by Intel, so if there's going to be any sort of fix or even a partial mitigation for this threat that can be retrofitted to older Thunderbolt controllers, that would have to come from them first.  But Intel hasn't said anything about that yet, so it's not clear that that would even be possible.  Until then, I have to agree with the initial reply in this thread, that the best mitigation is to maintain physical security of your system as much as possible -- which in fairness has always been a recommended practice, because if an attacker has physical access to your system, then there's all sorts of damage they can do.

@syrenity  what exact XPS model do you have?  Not just a "model year", but the actual model number.  And what OS are you running?  If it's Windows 10, what release version?  The 2019 reference being quoted for ThunderSpy is because that's when Intel released their "Titan Ridge" Thunderbolt controller that supports Kernel DMA Protection.  And at least some XPS systems released that year support it, such as the XPS 13 7390 and the newer 9300.  But using Kernel DMA Protection requires support from the hardware, firmware, OS, and drivers, so it's possible that your system model supports it while one of those components is the issue.

I have the 9570 model, which shows as vulnerable.

Intel has posted a response, which unfortunately doesn't help much as nearly all ports on my XPS (including the display ones) are TB:

https://blogs.intel.com/technology/2020/05/more-information-on-thunderspy/

Dell is aware of the Thunderbolt security research described by researchers as “Thunderspy.” Dell Client Consumer and Commercial platforms that shipped starting in 2019 have Kernel DMA protection when Secure Boot is enabled, which offers protection from “Thunderspy” per Intel guidance.

Windows-based Dell platforms have Kernel DMA Protection support enabled by default (Windows 10 version 1803 onwards). Since this attack requires physical access, we recommend customers follow security best practices and prevent unauthorized physical access to devices.

I just checked, and I have the DMA protection disabled for some reason in Windows. Perhaps some setting should be enabled in Bios?

@syrenity  Seeing "Disabled" does not necessarily mean "Supported but disabled".  It can mean "Disabled and not supported".  I don't think that Windows field distinguishes between those two conditions.  To my knowledge, systems that support Kernel DMA Protection ship with it enabled out of the box.  You can certainly check your BIOS, but if you have an XPS 15 9570, I suspect that your system doesn't support it.  You say it's a 2019 model, but it actually launched in 2018 even if you bought it new in 2019.  The XPS 15 model that launched in 2019 was the next generation, which was called the XPS 15 7590 (it seems Dell briefly considered using the 7000 model naming scheme for their XPS systems to align with their other product lines, then switched back to keeping them in the 9000 range).