ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification • Hacker News Board

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#161

Post by grawlinson » Sun, Jun 05, 2016, 10:38 PM UTC

Kubuxu wrote: post #103

egeozcan wrote: post #13

Earlier quoted context omitted.

I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.

I hate this idea as it usually means that you have to run Windows to upgrade BIOS...

You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release.

Solution? New BIOS firmware. Problem? Can only update via Windows binary.

I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#162

Post by LeifCarrotson » Sun, Jun 05, 2016, 10:44 PM UTC

userbinator wrote: post #49

ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

In the case of routers, things are beginning to change because the FCC is requiring that manufacturers prevent users from modifying radio parameters to their satisfaction and the easiest way to do that is to prevent users from using OSS firware The flip-side is that this isn't the sort of security most of us want, and the fact that router firmware is "insecure" from this perspective is what enables things like DD-WRT…

> See also: iOS jailbreaking, Android rooting, console homebrew, etc.

Let's go back a step: Why do all of those things exist?

It seems like it would be fairly easy. Use ARM TrustZone or Intel TXT trusted environments to host a non-writeable firmware, with one-time-programmable key storage, verifies that the contents of the boot memory are correctly signed by the key. If it is, then boot. If not, don't (copy in and verify a last-known-good backup image or something).

If the manufacturer wants to create an update, they take the code to the CTO's office safe, and compile and sign the image with the air-gapped machine that holds the private key.

If the private key is not leaked, jailbreaking is impossible. Doesn't seem that hard.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#163

Post by shirro » Sun, Jun 05, 2016, 11:15 PM UTC

The first thing I did when I got my ASUS UX303UA was re-partition and install Arch Linux. Works flawlessly and I avoid issues with this sort of half baked bloatware. I haven't done any BIOS updates because ASUS doesn't publish detailed changelogs and I don't know if they are required or might cause problems. Excellent hardware company that probably should just stick to hardware.

Just an aside, but I have been out of the loop for awhile with Windows but I couldn't believe how ugly Windows 10 looked when I booted it. I currently float between Mac, ChromeOS and Gnome and my favourite at the moment is still the material design look. Windows seems to be getting uglier. It is a shame because, although different, I am not sure it is functionally all that much worse these days.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#164

Post by AdamN » Sun, Jun 05, 2016, 11:53 PM UTC

newman314 wrote: post #122

ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

He's not totally wrong. If the package is signed and the public key is trusted (the bigger 'if' actually) and the package signature passes - then it doesn't matter how it was transported. Even email is fine.

With that said, security needs to be in layers and defense in depth is critical, especially for this type of core infrastructure.

He should upgrade all infrastructure points for better security where feasible.

There's also the political reason not to use Cloudflare ... we're quickly moving to a darker Internet where traffic goes into networks like Cloudflare and nobody knows what happens inside the black box. I wonder if that's where the resistance lies.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#165

Post by maxsilver » Sun, Jun 05, 2016, 11:58 PM UTC

superuser2 wrote: post #160

maxsilver wrote: post #136

Earlier quoted context omitted.

> Why would I want to be stuck with a 5-generation-old navigation/music player system when the car is still fine? Why would you be? Isn't this a solved problem? When you want to upgrade your entertainment system, you head to somewhere like Crutchfield or Sonic or Best Buy and buy a new one to plug in. In many cars, it takes less time to install a new car infotainment unit than it takes to buy a new iPhone from a carr…

I think this was true for a while in the mid 2000s when radio units were more or less commodotized, but these days the big center console touch screens are deeply integrated with the car. Even settings like engine timings (sport/eco modes), suspension, steering feedback, etc. are a page or two away from the FM radio. Some have HVAC on the same system. There's also integration with steering wheel buttons, and sometime…

> I think this was true for a while in the mid 2000s when radio units were more or less commoditized, but these days the big center console touch screens are deeply integrated with the car

There's still dozens of brand-new cars that sell without a locked down center console.

For example, you could buy an 100% electric brand new 2016 Nissan Leaf. It ships today with an infotainment center you can "just replace it and get identical/better functionality" anytime you'd like. Despite being upgradable, it still supports many modern features (such as GPS, Apple CarPlay, Rear-view backup camera, etc)

At some point, people are making a choice. If you don't want to be stuck with an unmaintained computer in your car, buy any of the dozens of brand-new modern vehicles that let you freely upgrade whenever you like.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#166

Post by bigiain » Mon, Jun 06, 2016, 12:25 AM UTC

matthewaveryusa wrote: post #153

pricechild wrote: post #146

Earlier quoted context omitted.

You don't need to verify it on the target system though?

You sign at the source with a private key, and you verify on the target with the public key. The trick is only someone with the private key can create a signature that the public key can verify.

The other problem is many people wont have pre-existing copies of the required private key available. If your attacker is in a position to MitM your download of a signed binary, they're probably also in a position to MitM your retrieval of the public key. SSL/TLS certainly helps there (at least the attacker then also needs to be capable of acquiring root CA signed TLS certs for the download site and any readily available PGP key sites. It wont slow the NSA down much - but it will help against the guy with the WiFi Pineapple in your local Starbucks…)

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#167

Post by snuxoll » Mon, Jun 06, 2016, 12:31 AM UTC

icebraining wrote: post #68

Dagwoodie wrote: post #56

Earlier quoted context omitted.

My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cv…

Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. Which is why computer OSs should start treating these as the potential hostile devices they are. None of this "trusted network" nonsense, no unencrypted or unauthenticated connections between devices on the same LAN, etc.

Now that IPv6 deployment is getting up there it'd be really nice to see increased use of IPSec. No need to rely on the network that I'm on or the potential that some actor has attempted to MITM a TLS connection (because a lot of people are just going to ignore TLS warnings, unfortunately).

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#168

Post by snuxoll » Mon, Jun 06, 2016, 12:34 AM UTC

yuhong wrote: post #116

dbcurtis wrote: post #95

Earlier quoted context omitted.

That culture comes from the Darwinian selection of the marketplace. If you make chips, after you tape out, the design organization must absolutely turn their focus to creating the chip that will obsolete it or someone else will eat your lunch. In a hardware organization, long attention span is a liability, not an asset. With software, the road to success is incrementally increasing your value to the customer with eac…

What is fun is that Intel is still trying to hold OEMs to a one year cycle even as fabrication tech advances are slowing.

Considering the number of bugs that continue to show up in every new hardware iteration Intel has pushed since Haswell I'm rather surprised they haven't increased their cycle, I have a Haswell i5 in both my desktop and my 2014 XPS 13 and I shudder at the thought of upgrading (which thankfully I have no reason to, like you said advances are much slower these days anyway).

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#169

Post by caf » Mon, Jun 06, 2016, 12:47 AM UTC

ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

When you do figure out the whole building process, you should think about documenting it if you have the time.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#170

Post by ArchD » Mon, Jun 06, 2016, 12:47 AM UTC

If "unauthorized access" to computer systems without actual damage to said systems were not outlawed, there might be people who would make harmless exploits against such irresponsible vendors and publicly shame them (in the eyes of the general non-techy public) into action.

Alas, it's illegal to "exploit" but not illegal for system vendors to enable exploits through negligence. Thus, because of how the law is written, vendors have little incentive to care about security and well-meaning white hats are disincentivized from demonstrating the vendors' irresponsibility.