ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification • Hacker News Board

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#121

Post by Someone » Sun, Jun 05, 2016, 6:23 PM UTC

ikeboy wrote: post #38

Someone wrote: post #33

I fear that, as a bonus, there is a race condition where a local attacker can replace any update with its own 'update' between download and installation. Worst-case, they might have implemented this like this: DownloadNewUpdatesIntoUpdateDirectory(); ProcessWhateverYouFindInTheUpdateDirectory(); If that's the case, you would only need to copy a payload to that directory.

A local attacker can mitm anyway, no?

"Local" to the computer, not the network. If a 'normal' user you can create a file that will get run with administrator privileges, that's equivalent to a UNIX root exploit.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#122

Post by newman314 » Sun, Jun 05, 2016, 6:24 PM UTC

ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure.

Maybe if sufficient number of people pester him about it.

EDIT: On a related note, I've been trying to get the ddwrt guys to improve their HTTPS setup (ciphers etc.) without much success. To me, testing with testssl.sh and fixing the errors that pop up is easy and not that much work.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#123

Post by newman314 » Sun, Jun 05, 2016, 6:29 PM UTC

UnoriginalGuy wrote: post #100

imglorp wrote: post #73

Earlier quoted context omitted.

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

Actually, that's not quite true. I know of at least one manufacturer whose internal commitment is 15 years. HOWEVER, the problem is all the third party interfaces that these systems increasingly leverage.

I can pretty much guarantee that Google Maps is not going to be the same 15 years down the road and I very much doubt Google has the interest in supporting something for that period of time. So somewhere down the road, we'll end up with all these cars that part of the early stages of connected cars that end up having completely unusable systems.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#124

Post by newman314 » Sun, Jun 05, 2016, 6:31 PM UTC

kuschku wrote: post #119

sleepychu wrote: post #79

Earlier quoted context omitted.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again. Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.

There are ACME clients that can automate the DNS challenge process.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#125

Post by superuser2 » Sun, Jun 05, 2016, 6:32 PM UTC

UnoriginalGuy wrote: post #100

imglorp wrote: post #73

Earlier quoted context omitted.

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

Yep. I find it baffling that people in the tech industry (who should know better) are enthusiastic about vehicle infotainment systems, Apple CarPlay, Android Auto, etc.

Keep it simple. Power, a 3.5mm audio connector, and a windshield suction mount. Something they can't screw up too badly. I can easily buy a new smartphone every 2 years, but a car I'm going to hold on to for more like 10. Why would I want to be stuck with a 5-generation-old navigation/music player system when the car is still fine?

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#126

Post by newman314 » Sun, Jun 05, 2016, 6:33 PM UTC

userbinator wrote: post #46

philliphaydon wrote: post #17

Damn ASUS that's a real shame, because that Royal Blue Zenbook 3 is god damn sexy https://www.asus.com/Notebooks/ASUS-ZenBook-3-UX390UA/

Ironic that your link to the ASUS site is (working) HTTPS. I checked the liveupdate01.asus.com and dlcdnet.asus.com domains referenced in the article, and they can certainly serve over HTTPS...

I wonder if someone has built a transparent proxy/router level implementation of HTTPS Everywhere... That might be quite useful.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#127

Post by Raj123123 » Sun, Jun 05, 2016, 6:35 PM UTC

bcook wrote: post #74

Dagwoodie wrote: post #56

Earlier quoted context omitted.

My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cv…

The Asus version of the 2.6.22.19 Linux kernel has many, many backports, so a simple vuln search for vanilla Linux 2.6.22.19 will not yield pertinent results.

Fine but many router vendors do not push updates for deployed routers. Majority of ordinary users barely know how to plug in an ethernet cable let alone download&update firmware.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#128

Post by Raj123123 » Sun, Jun 05, 2016, 6:40 PM UTC

UnoriginalGuy wrote: post #100

imglorp wrote: post #73

Earlier quoted context omitted.

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

My car getting hacked could potentially cause loss of life - my router or laptop can't so easily. However, some security can be had by enforcing physical-only updates. My router requires updates by ethernet cable (physical) so I would prefer my car to be the same - even if I have to bring it into a certified shop.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#129

Post by heeen2 » Sun, Jun 05, 2016, 6:46 PM UTC

superuser2 wrote: post #125

UnoriginalGuy wrote: post #100

Earlier quoted context omitted.

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

Yep. I find it baffling that people in the tech industry (who should know better) are enthusiastic about vehicle infotainment systems, Apple CarPlay, Android Auto, etc. Keep it simple. Power, a 3.5mm audio connector, and a windshield suction mount. Something they can't screw up too badly. I can easily buy a new smartphone every 2 years, but a car I'm going to hold on to for more like 10. Why would I want to be stuck…

Carplay and android auto are solving this problem by running all the logic on the phone. Android auto is literally a h264 stream of content generated on the phone and a reverse stream of input events from the car display to the phone. All the updating will happen on the phone.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#130

Post by qb45 » Sun, Jun 05, 2016, 7:01 PM UTC

etatoby wrote: post #52

Kubuxu wrote: post #3

Earlier quoted context omitted.

Worst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.

Someone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS. That should be enough to make them take security seriously (and not really hurt anybody.)

Or with Apple logo, for some extra confusion and hilarity.