Such sophisticated attacks always amaze me, and I've always wondered how people go about developing them in the first place.
CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
11–20 of 125 posts
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#12That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
I would argue that the complexity of TPMs[1] and UEFI[2] leads to a larger attack surface with more bugs present, making it easier to launch attacks such as the one described. The opaqueness of these technologies and inability for and difficulty of security researchers to investigate and debug implementations of these technologies does not help either. There is no chance of a typical system owner having the time and skill to understand TPM and UEFI technologies in enough detail to know whether their systems are vulnerable or compromised.
[1] Example: 176 pages at https://trustedcomputinggroup.org/wp-content/uploads/PC-Clie...
[2] Example: 2540 pages at https://uefi.org/sites/default/files/resources/UEFI_Spec_2_9...
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#13as a civilian, I am repeatedly amazed at the relentless, intrusive and manipulative tactics that the "heroes" use on the "sheep" .. I am quite capable of managing my own affairs and have invented and solved using computers for decades. I have a sense of personal sovreignty that is offended and threatened by one-way-mirror, controlling, destructive Spy-vs-Spy comic books being played out by eternally funded jerks. I a…
This! ^
Tech companies are all subjects to the government in which they operate.
They have become spies. The real terror is when you can't buy chips that don't spy on you.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#14That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
The problem with pluton is not the tech. It's that: - it's proprietary - it's controlled by entities that have a terrible track record - it's going to be, as usual, forced upon everybody without consent
I have argued the same as you, it needs to be open source to fix the first two points.
For the third one, nobody is forcing you to buy a specific product, but yes, it will be hard to avoid.
But like for vaccines, individual consent is at odds with the greater good. Society needs computing that it can trust.
Maybe the solution is a healthier hobbyist market where you can buy "use at your own risk" unlocked computers? Maybe we need laws to force manufacturers to make such models? I don't know. But most people, from my mom to my CEO need a computer that will run what it is supposed to run.
It's not 1990 any more, PCs do way too important things.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#15That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
I'm not certain this is where Pluton or a TPM could've helped much (individually), it's more the task of Secure Boot, Secure Launch(/DRTM) and Trusted Boot.
I'd love to see a similar effort at ensuring boot integrity for Linux, but way too many distros can't even handle Secure Boot with Nvidia/DKMS. Though even more practical features, one being (f)TPM-backed FDE, are very cumbersome and underutilised.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#16If you have good info or known to have “good” info, just assume you are being watched.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#17That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
I would argue that the complexity of TPMs[1] and UEFI[2] leads to a larger attack surface with more bugs present, making it easier to launch attacks such as the one described. The opaqueness of these technologies and inability for and difficulty of security researchers to investigate and debug implementations of these technologies does not help either. There is no chance of a typical system owner having the time and…
> There is no chance of a typical system owner having the time and skill...
Hence the suggestion to make it tamper obvious.
As for the attack surface, it is true, but it's a separate problem. You don't have to bloat your firmware to make it trusted.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#18That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
I'm not certain this is where Pluton or a TPM could've helped much (individually), it's more the task of Secure Boot, Secure Launch(/DRTM) and Trusted Boot. I'd love to see a similar effort at ensuring boot integrity for Linux, but way too many distros can't even handle Secure Boot with Nvidia/DKMS. Though even more practical features, one being (f)TPM-backed FDE, are very cumbersome and underutilised.
I was being a bit provocative with Pluton :-) I know it presses people's buttons...
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#19That's why things like the Pluton processor and TPMs are useful. (A rain of downvotes falls on me) Seriously, even good old BIOS is susceptible to rootkits, there has been tons of them. So no crying over UEFI please. We need a fully signed and auditable chain of trust for booting OSes. Of course all this crap needs to be open source but it needs to be locked down to prevent not trusted binaries as much as possible. A…
I would argue that the complexity of TPMs[1] and UEFI[2] leads to a larger attack surface with more bugs present, making it easier to launch attacks such as the one described. The opaqueness of these technologies and inability for and difficulty of security researchers to investigate and debug implementations of these technologies does not help either. There is no chance of a typical system owner having the time and…
In theory yes, more functionality means more surface, but then some aspects are fundamentally designed to be less exposed or dangerous. We will keep on finding a bunch of bugs in those implementations, but I suspect the end result is better than what we could've ever had with BIOS.
I don't think there was any chance for a typical system owner to have the time or skill or even the foundation required to understand if their machine's BIOS is vulnerable or compromised. UEFI provides some basis to actually start with that process.
I also think there is a real opportunity to write open-source versions of these components in safe/verifiable languages. That way we could have our cake and eat it too.
Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit
#20Such sophisticated attacks always amaze me, and I've always wondered how people go about developing them in the first place.
someone who worked on the UEFI implementation writes it