Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

131–140 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#131

Post by lallysingh »

newman314 wrote: post #122
ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

Why isn't it? I'm sorry, I'm genuinely curious.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#132

Post by brudgers »

ams6110 wrote: post #55
brudgers wrote: post #18

Earlier quoted context omitted.

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't c…

Except if that were the case, it's even cheaper to not develop a live update capability at all. They went through the process of specifying and developing a automated utility that downloads files, parses manifests and then acts accordingly to install BIOS or other updates, tested it and bundled it with their retail system build, and after all that effort didn't take the one tiny step to sign their files or at least p…

My observation is that consumer grade laptops have upgradable BIOS to handle bugs, but there's only a brief lifecycle in which the manufacturer performs updates of about a year to coincide with a typical [US] manufacturer's warranty. My suspicion is that providing the upgrade service is cheaper than the combination of resulting warranty claims and potential lawsuits which could result from not fixing the BIOS automatically.

I don't deny the possibility that adding TLS to the update mechanisms might make the world better. On the other hand, I haven't seen a business case that shows a clear benefit for company's like ASUS to change all the moving parts in their logistics chain. Admittedly, I haven't looked very hard.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#133

Post by qb45 »

sgeisenh wrote: post #81
userbinator wrote: post #44

I don't remember the brand(s) exactly --- don't think it was ASUS however --- but I do remember a few years ago of laptops which would automatically and silently download and install BIOS updates, and inevitably some of them would fail, leading to bricked machines. IMHO the BIOS is not something that should ever change unless there's a very important reason to, and even then it should be on the explicit action and co…

ASUS has a tendency to have very important reasons to update the BIOS. The last few Intel chipsets, they've had serious BIOS issues at launch that can cause tremendous headaches (random freezes, blue screen, etc.).

In fact, the last few Intel CPU generations had issues at launch which had to be resolved with BIOS workarounds.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#134

Post by brudgers »

icu wrote: post #51
ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

Thanks for posting this comment. Is there any way you could write a detailed how to blog post going over this project?

For what it's worth Buffalo makes DD-WRT routers in a box that are built and priced for the consumer market.

http://www.buffalotech.com/products/wireless

My home network as two of them...and a WRT54g with dd-wrt on the Xbox 360. Buffalo has been around at least since the early 1990's when they sold printer buffers.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#135

Post by tajen »

lallysingh wrote: post #131
newman314 wrote: post #122

Earlier quoted context omitted.

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

Why isn't it? I'm sorry, I'm genuinely curious.

Over what channel do you retrieve the signature?

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#136

Post by maxsilver »

superuser2 wrote: post #125
UnoriginalGuy wrote: post #100

Earlier quoted context omitted.

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

Yep. I find it baffling that people in the tech industry (who should know better) are enthusiastic about vehicle infotainment systems, Apple CarPlay, Android Auto, etc. Keep it simple. Power, a 3.5mm audio connector, and a windshield suction mount. Something they can't screw up too badly. I can easily buy a new smartphone every 2 years, but a car I'm going to hold on to for more like 10. Why would I want to be stuck…

> Why would I want to be stuck with a 5-generation-old navigation/music player system when the car is still fine?

Why would you be? Isn't this a solved problem?

When you want to upgrade your entertainment system, you head to somewhere like Crutchfield or Sonic or Best Buy and buy a new one to plug in. In many cars, it takes less time to install a new car infotainment unit than it takes to buy a new iPhone from a carrier store. (It's often cheaper too).

For people afraid of wires, bored teens at Best Buy will install it all for you for an extra $70.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#137

Post by yoha »

tajen wrote: post #135
lallysingh wrote: post #131

Earlier quoted context omitted.

Why isn't it? I'm sorry, I'm genuinely curious.

Over what channel do you retrieve the signature?

A signature is not a hash. As long as you know the right public key (which only needs to be transferred once), you can verify the legitimacy of the signature regardless of how it was transmitted.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#138

Post by userbinator »

mattthebaker wrote: post #89
ams6110 wrote: post #55

Earlier quoted context omitted.

Except if that were the case, it's even cheaper to not develop a live update capability at all. They went through the process of specifying and developing a automated utility that downloads files, parses manifests and then acts accordingly to install BIOS or other updates, tested it and bundled it with their retail system build, and after all that effort didn't take the one tiny step to sign their files or at least p…

Field firmware updates for hardware are to greatly reduce the risk a product needs to be recalled -- this is a worst case scenario with great cost for the manufacturer. To some extent it also reduces the pre-ship software verification costs -- potential damage from a bug slipped is greatly reduced. Security risks are harder to quantify for the bottom line.

To some extent it also reduces the pre-ship software verification costs -- potential damage from a bug slipped is greatly reduced.

It also encourages reducing effort spent in fixing bugs before release, which is why I absolutely loathe this "update culture": the "we can always fix it sometime later" mentality is like procrastination, and leads to barely-working products being released.

It is true that before easy field-updateability, products did ship with unfixable bugs, but I feel like it has only gotten worse from there.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#139

Post by deno »

newman314 wrote: post #122
ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

Transferring signed packages over TLS only prevents the attacker from observing which particular packages are being updated, and that’s assuming the padding alone is sufficient to obscure identification by size.

Otherwise signing packages is actually preferred, because you can do it offline, so that hacking the server is not enough to push malicious code.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#140

Post by joosters »

sleepychu wrote: post #79
kuschku wrote: post #75

Earlier quoted context omitted.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

You're missing the point. The OP isn't claiming that Lets Encrypt is impossible to configure, so telling them that there are ways to make it work is a bit pointless. The key is that Lets Encrypt can be very difficult to configure and get things working. In a way, the numerous methods available to set up LE add to the confusion, you can search around and find lots of conflicting 'best' ways to do it.
Post reply on HN