Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

171–180 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#171

Post by __david__ »

maxsilver wrote: post #165
superuser2 wrote: post #160

Earlier quoted context omitted.

I think this was true for a while in the mid 2000s when radio units were more or less commodotized, but these days the big center console touch screens are deeply integrated with the car. Even settings like engine timings (sport/eco modes), suspension, steering feedback, etc. are a page or two away from the FM radio. Some have HVAC on the same system. There's also integration with steering wheel buttons, and sometime…

> I think this was true for a while in the mid 2000s when radio units were more or less commoditized, but these days the big center console touch screens are deeply integrated with the car There's still dozens of brand-new cars that sell without a locked down center console. For example, you could buy an 100% electric brand new 2016 Nissan Leaf. It ships today with an infotainment center you can "just replace it and…

You're not wrong, but most people (even the tech minded) choose their new car by something other the center console features—there are many more important criteria to consider. In the 90s many people ended up with cassette players in their car when they would have preferred CD players.

On my car I had to open up the radio and modify it by hand to accept aux input. Still, I wouldn't have chosen a different car. The other parts of of it are far more important, even if it does irk me that the center console isn't DIN compatible.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#173

Post by DarkLinkXXXX »

LeifCarrotson wrote: post #162
userbinator wrote: post #49

Earlier quoted context omitted.

In the case of routers, things are beginning to change because the FCC is requiring that manufacturers prevent users from modifying radio parameters to their satisfaction and the easiest way to do that is to prevent users from using OSS firware The flip-side is that this isn't the sort of security most of us want, and the fact that router firmware is "insecure" from this perspective is what enables things like DD-WRT…

> See also: iOS jailbreaking, Android rooting, console homebrew, etc. Let's go back a step: Why do all of those things exist? It seems like it would be fairly easy. Use ARM TrustZone or Intel TXT trusted environments to host a non-writeable firmware, with one-time-programmable key storage, verifies that the contents of the boot memory are correctly signed by the key. If it is, then boot. If not, don't (copy in and ve…

Please, don't give them ideas.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#174

Post by maxsilver »

jimbobimbo wrote: post #158
maxsilver wrote: post #155

Earlier quoted context omitted.

I'm using a Toyota Yaris as an example. All recent models (including the current 2016 model) can be swapped out easily. With Electric cars / Hybrids, I can see issues since they integrate environmental controls and other stuff in to their radios. I suspect as electric cars become more common, entertainment companies will start building units with support for those features.

Interesting... Wouldn't think anybody still does it. It's already impossible to do in 5th-gen Camaros, for example (2010-2015). I wouldn't be surprised that other Chevy cars are the same way.

> It's already impossible to do in 5th-gen Camaros, for example (2010-2015)

Is that actually true?

I'm no expert, but Crutchfield claims a 2010-2015+ Camaro can take almost any new infotainment box you'd like from their site. (Both Single or Dual DIN).

They claim you'll also retain all OnStar, audible safety alerts, and climate control functionality with your upgrade, regardless of the upgrade you choose.

See : http://www.crutchfield.com/p_120993010S/Metra-99-3010-Dash-a...

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#175

Post by ryao »

ryao wrote: post #62
icu wrote: post #51

Earlier quoted context omitted.

Thanks for posting this comment. Is there any way you could write a detailed how to blog post going over this project?

> Thanks for posting this comment. Is there any way you could write a detailed how to blog post going over this project? I will see about writing something up after I am happy with my reconfigured network. Right now, I have more to do before I am happy with it.

I ended up flashing a fork of OpenWRT after learning that someone was working on support and had patches on github:

https://github.com/lede-project/source/pull/6

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#176

Post by ambrosechua »

nextos wrote: post #96
daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

It also bothers me a lot most manufacturers provide OS-dependent tools for updating UEFI. So if you want to use something as exotic as Linux, you need to keep a bootable partition / USB with Windows somewhere...

Not all the time. Majority of motherboards, and some laptops, update their UEFI via a USB drive.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#177

Post by colejohnson66 »

etatoby wrote: post #52
Kubuxu wrote: post #3

Earlier quoted context omitted.

Worst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.

Someone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS. That should be enough to make them take security seriously (and not really hurt anybody.)

Sadly, with the current state of the law, you'd be prosecuted for hacking and ASUS goes free. Which is ridiculous.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#178

Post by uudecode »

LiveUpdate runs on any OS the purchaser might install, or just Windows?

I have never had to perform a BIOS update with any off the shelf computer from ASUS.

I have looked at the BIOS updates on offer. I cannot recall that they were always hosted on a server using HTTPS. Or that MD5 signatures were provided.

But my understanding was that only users that knew what they were doing applied BIOS updates after purchase.

Is flashing the BIOS really common with ordinary users?

It's a major change and not something I would want to be done automatically by a third party.

This auto-updating craze is becoming a bit farcical.

Running programs that let third parties open ports, and run downloaded executables.

But the concern is whether someone can MITM or tamper with the download?

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#179

Post by qb45 »

grawlinson wrote: post #161
Kubuxu wrote: post #103

Earlier quoted context omitted.

I hate this idea as it usually means that you have to run Windows to upgrade BIOS...

You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...

Solution: buy computers with "generic" motherboards, not OEM boxes.

I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup.

And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#180

Post by breakingcups »

AdamN wrote: post #164
newman314 wrote: post #122

Earlier quoted context omitted.

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

He's not totally wrong. If the package is signed and the public key is trusted (the bigger 'if' actually) and the package signature passes - then it doesn't matter how it was transported. Even email is fine. With that said, security needs to be in layers and defense in depth is critical, especially for this type of core infrastructure. He should upgrade all infrastructure points for better security where feasible. Th…

The problem with that is that, if you as a malicious third person can MITM the http connection for updates, you can push an older signed package with known vulnerabilities.
Post reply on HN