Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

securelist.com

Post reply on HN
Print view View original

61–70 of 125 posts

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#61

Post by bri3d »

ggm wrote: post #3

I live in fear of being told my factory delivered Dell rackable servers have been EFI infected since inception on my network. It's silly to pretend a BSD OS is going to be immune of the consequences of an EFI which is compromised at birth. Sooner or later there will be a value chain in compromising my OS, through the EFI. I wish we had better out of band EFI validity checks, based on what the manufacturer thinks shou…

https://github.com/chipsec/chipsec

It's not out of band and therefore vulnerable to massively clever malware, but it's still useful.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#62

Post by blueflow »

fezfight wrote: post #60
blueflow wrote: post #58

Earlier quoted context omitted.

A lot of people don't like idealism so strongly that they'd rather stick with old hardware over the newest hyped-to-death shit.

Just in case it isn't clear, I wouldn't have called you reactionary or paranoid back then because I would have agreed with you. Its just sad that others choose not to open their eyes.

No post body was provided.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#63

Post by Arnavion »

hgazx wrote: post #55
hulitu wrote: post #48

Earlier quoted context omitted.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

What systems are those? Windows doesn’t allow you to do that by default unless you’re an admin.

Any systemd-using Linux distro will also automount /efi as writable only by root (assuming the mount was generated by GPT auto generator, not by a specific fstab entry), so it's not that either.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#64

Post by no_time »

fguerraz wrote: post #14
BiteCode_dev wrote: post #10

Earlier quoted context omitted.

The problem with pluton is not the tech. It's that: - it's proprietary - it's controlled by entities that have a terrible track record - it's going to be, as usual, forced upon everybody without consent

I have argued the same as you, it needs to be open source to fix the first two points. For the third one, nobody is forcing you to buy a specific product, but yes, it will be hard to avoid. But like for vaccines, individual consent is at odds with the greater good. Society needs computing that it can trust. Maybe the solution is a healthier hobbyist market where you can buy "use at your own risk" unlocked computers?…

>Society needs computing that it can trust.

The playbook that is unfolding right now with pluton is the exact opposite.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#65

Post by ActorNightly »

hulitu wrote: post #48
ActorNightly wrote: post #36

Earlier quoted context omitted.

Most modern exploits on this level are extremely difficult to get onto users machines - without any conspiracy at play, you would have to essentially get users to run untrusted code, and for general use case there are a whole bunch of blockades against this. For private entities seeking financial gain, its completely pointless to burn a zero day like this for the return that you would get.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

Sure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser.

Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#66

Post by rolph »

eikenberry wrote: post #47
bitwize wrote: post #42

Earlier quoted context omitted.

You know what'll help? Pluton. The future of computing is a signed code path from power on to end-user application code with multiple layers of sandboxing in between. With so many hostile actors, from script kiddies to government agencies out there, "general purpose computing" (which, from a security standpoint, is just arbitrary code execution) just isn't viable anymore. We need provable attestation that no layer of…

As long as we control each layer this sounds great. What are you thinking, some sort of physical switches on the computer that turns on and off access to the layers from software so you can control them individually? That's the tricky part, how to switch those layers on and off so you can work with them in a non-software controlled way.

yes that is a problem, even bigger is that pluton is intended to make this as close to impossible as is possible.

pluton is about burying TPM and keys in the processor package rather than as a separate host on the bus. this could be defeated by using microsurgical technique to reveal the die and alter the connections, an extreme effort requireing an extreme motivation.

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#67

Post by viknesh »

ActorNightly wrote: post #65
hulitu wrote: post #48

Earlier quoted context omitted.

Really ? On some of my computers the UEFI partition is a FAT32 partition writable by anyone by default.

Sure, from your computers OS. Its not like javascript loaded from the web can write to your UEFI unless you use an insecure browser. Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.

I think the point of the original comment was that it's extremely feasible for attackers this sophisticated to have access to browser 0 day which would allow fs access, "insecure" browser or not

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#68

Post by [deleted] »

jeroenhd wrote: post #46
rwaksmunski wrote: post #38

My hopes of large volume fully open source systems died when I learned that beefy RISC V boards will ship with UEFI.

UEFI can work open source no problem. You'll still need binary blobs for memory initialisation and such, because no open systems exist for that, but the boot process isn't really closed. Aside from open source UEFI setups like Tiano, you can also use CoreBoot or LinuxBoot where UEFI doesn't work for you.

[deleted]

Re: CosmicStrand: The discovery of a sophisticated UEFI firmware rootkit

#69

Post by Arnavion »

tepitoperrito wrote: post #31

Furious searches for BIOS only era hardware are taking place on ebay as we speak. To use with a modified Linux kernel that emulates a bog standard Thinkpad uefi environment of course. EDIT: I forgot to phrase this as a question - besides missing a QubesOS or KickSecure on top, is this a decent plan for airgapped stuff?

I'm not sure what you mean by "a modified Linux kernel that emulates a bog standard Thinkpad uefi environment". The UEFI environment is provided by the firmware and starts EFI applications, which could be a UKI containing your kernel+initramfs, or grub that then starts your kernel+initramfs from /boot, or anything else. ie the UEFI sits below the kernel.

UEFI can be emulated on top of BIOS using something like Clover. But for your BIOS-only mobo, just keep using it with a BIOS-only bootloader, ie GPT disk with grub or whatever written to the MBR + BIOS Boot partition. There's no reason to involve any UEFI, emulated or otherwise.

You will obviously not have as good protection from evil maid attacks as you would've gotten from Secure Boot. But presumably you're okay with that, and emulated UEFI will not help in that regard anyway.

Post reply on HN