Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter Client for UEFI

github.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: Twitter Client for UEFI

#101

Post by base20 »

Ya'll ain't seen nothing yet. For a time the leading UEFI vendor, Phoenix Technologies, had a web browser in their UEFI BIOS. Some photos from WinHEC 2005 can be seen here: https://www.anandtech.com/show/1670/8

This was part of their "eBetween" UEFI BIOS that enabled them to show ads during boot-up (seriously) and also install software to Windows with what they called "Virtual Bundling Technology": https://indexarticles.com/business/business-wire/phoenix-tec... and https://www.cnet.com/tech/tech-industry/phoenix-jumps-on-web...

tl;dr version: UEFI can download software from the internet, copy it to the Windows partition, edit the registry, and even add desktop icons and IE bookmarks. Phoenix sought to productize this.

If you've ever seen a Windows PC where you just couldn't get rid of certain pieces of software or icons, it may have been eBetween at work. This is effectively the same thing as the persistent malware attacks described in numerous security blogs. Phoenix has since rebranded their UEFI codebase to (irony alert!) SecureCore.

Re: Twitter Client for UEFI

#102

Post by jotm »

matth3 wrote: post #82
jotm wrote: post #78

Earlier quoted context omitted.

This should be common knowledge among everyone using a computer. It just makes sense to know how your device operates, and it's not hard to learn. Having been the go to guy for fixing anything remotely computer related, I got sick of it and I just wish everyone could fix their own stuff :D

Why stop at using a computer, you could apply this sentiment to every item anyone may use. We should all have a decent grasp of molecule rotation and the electric dipole moment before zapping that meal in the microwave!

I said "should" and I meant it.

You don't have to, no one has to.

People can use locked down hardware and be at the mercy of the manufacturers and support services.

There's a lot more money in that than everyone fixing their own shit.

Same way people who know nothing about how democracy and their country works can still vote. For some reason, they often want more authoritarianism, go figure.

And those replies of "why not know everything hehe" always lead to dismissing the whole argument.

Re: Twitter Client for UEFI

#103

Post by jotm »

LASR wrote: post #81
jotm wrote: post #78

Earlier quoted context omitted.

This should be common knowledge among everyone using a computer. It just makes sense to know how your device operates, and it's not hard to learn. Having been the go to guy for fixing anything remotely computer related, I got sick of it and I just wish everyone could fix their own stuff :D

You seem to have a frustration with people around you. I don’t think the problem is with what people should know, but don’t.

I don't anymore, because I understood I can't affect other people, so I must not care.

However it is my opinion that people should learn and know more. Not everything, just more than they already do.

Re: Twitter Client for UEFI

#104

Post by mjg59 »

WaitWaitWha wrote: post #100
mjg59 wrote: post #87

Earlier quoted context omitted.

> Something has to start reach and load the UEFI written on a 'boot media' No. The UEFI stack lives entirely in flash, the same as BIOS did.

In my experience, it may be on a detachable flash media, but it is not entirely in flash on the motherboard. That would be counter to 'expandability' concept of UEFI. I have never seen so much flash memory directly on the mobo to support UEFI.

Can you point at a machine like this? Literally every machine I've worked with has UEFI entirely implemented in motherboard flash.

Re: Twitter Client for UEFI

#105

Post by antifa »

loloquwowndueo wrote: post #9

If this allows me to use “latest tweets” chronological view as default instead of the brain dead “home” view I’m totally setting up a laptop with this. The official twitter clients are more atrocious each day (spaces? Home by default? 95% promoted tweets in my timeline? List suggestions I don’t care about?)

Twitter sends me fake notifications, despite me disabling them, then they follow up with notifications to check out my missed notifications.

Re: Twitter Client for UEFI

#106

Post by WaitWaitWha »

mjg59 wrote: post #104
WaitWaitWha wrote: post #100

Earlier quoted context omitted.

In my experience, it may be on a detachable flash media, but it is not entirely in flash on the motherboard. That would be counter to 'expandability' concept of UEFI. I have never seen so much flash memory directly on the mobo to support UEFI.

Can you point at a machine like this? Literally every machine I've worked with has UEFI entirely implemented in motherboard flash.

I think we are talking (writing) past each other.

What is the purpose of your EFI System Partition in your opinion? That is all I was referring to in the above notes.

Re: Twitter Client for UEFI

#107

Post by mjg59 »

WaitWaitWha wrote: post #106
mjg59 wrote: post #104

Earlier quoted context omitted.

Can you point at a machine like this? Literally every machine I've worked with has UEFI entirely implemented in motherboard flash.

I think we are talking (writing) past each other. What is the purpose of your EFI System Partition in your opinion? That is all I was referring to in the above notes.

It contains bootloaders.

Re: Twitter Client for UEFI

#108

Post by base20 »

secondcoming wrote: post #4

TIL: It's possible for UEFI code to access the internet. What could possibly go wrong?

How about this heap overflow bug in the UEFI bitmap (BMP) library: https://nvd.nist.gov/vuln/detail/CVE-2021-38577

Exploitable via network, no user interaction and no special privileges required. Scores 9.8 on a scale of 10 for severity from NIST. That's what happens when this stuff is done in such a highly privileged environment - simple bugs become security nightmares.

For comparison, Heartbleed scored a 7.5: https://nvd.nist.gov/vuln/detail/CVE-2014-0160

Secure boot and signed firmware won't save you, and in fact it could make things worse since it means even well-informed and capable users won't be able to fix it on their own. They're utterly helpless until their vendor fixes it and publishes an update.

Post reply on HN