Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

11–20 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#13

Post by egeozcan »

qb45 wrote: post #6
grawlinson wrote: post #2

Wow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything.

Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#15

Post by yxhuvud »

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

Why do you think they have an agency in and understand their decision? It seems a lot more probable that it is simple incompetence that is the underlying reason.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#16

Post by _RPM »

yxhuvud wrote: post #15
daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

Why do you think they have an agency in and understand their decision? It seems a lot more probable that it is simple incompetence that is the underlying reason.

And Hanlon's razor would agree with you.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#18

Post by brudgers »

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones.

BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't care. "BIOS updates with TLS!" stickers aren't going to improve sales.

Buying a laptop creates a consumer not a customer relationship. I want to pay the least, the manufacturer wants to deliver the least. A few years out, shiny-low-cost will drive my next purchase more than brand loyalty.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#20

Post by discreditable »

qb45 wrote: post #6
grawlinson wrote: post #2

Wow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.
Post reply on HN