http://puri.sm
"The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
Apple EFI Firmware Security Vulnerabilities
11–20 of 52 posts
Re: Apple EFI Firmware Security Vulnerabilities
#12http://puri.sm "The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
What CPU does it use? Does it need microcode?
Interesting thread on exactly how free this laptop is: https://trisquel.info/en/forum/librem-15-freelibre-and-open-...
(Edit: This post seems a bit harsh. My view is that any movement towards a more free laptop is welcome, especially since things like Android are going rapidly in the opposite direction)
Re: Apple EFI Firmware Security Vulnerabilities
#13Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper? It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise. It was certainly "inconvenient" to perform BIOS updates, but back in those days BIOS updates weren't all that common either. I don't think it should ever be "convenient" to do something like tha…
>Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper?
Remember how that was only for a short 1-2 years as a knee jerk reaction to CIH virus?
Older PCs had bios in EPROM (UV window on the chip) instead of EEPROM. That was the only physical protection. Later Intel introduced firmware hub (FWH) with software protection against flashing (you had to unlock certain memory region/io access), then we got SPI flash chips with some copy protection (again software controlled).
Jumper was a short lived, useless (after the fact) feature that died because nobody needed/wanted/asked for it.
Re: Apple EFI Firmware Security Vulnerabilities
#14http://puri.sm "The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
>i7-4770HQ
haha
Intel cant even get rid of binary blobs from their official open source Atom platform (minnowboard).
Intel UEFI bios is >100K lines of hand tuned spaghetti code that never saw version control system, thats straight from the mouth of Intel employee.
Re: Apple EFI Firmware Security Vulnerabilities
#15Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper? It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise. It was certainly "inconvenient" to perform BIOS updates, but back in those days BIOS updates weren't all that common either. I don't think it should ever be "convenient" to do something like tha…
I'm not sure if the jumpers were meant as a malware protection.
[...] make it impossible for the BIOS to be corrupted
by software, malicious or otherwise
Jumper JP4 controls the protection scheme that
prevents accidental damage to or rewriting of the data
stored in Flash memory.[1]
Re: Apple EFI Firmware Security Vulnerabilities
#16Out of curiosity: Can anyone point me where to find how a recent x86-cpu actually boots? Where's the code that gets executed in the first few CPU cycles?
The bulk of the firmware, that's clear, nowadays will be fetched from a serially connected flash, which this initial code will copy to the (then initialized) DRAM, also probably in several stages. But where do the first few instructions hide? Mask-rom in the CPU, or the chipset?
I know how initial bootup works on my day-job-default-CPU (a m68k/coldfire that basically just starts executing from a parallel connected flash), on a few ARMs and some PPC, but I have no idea about a "typical" intel core/i5..7/... CPU.
Re: Apple EFI Firmware Security Vulnerabilities
#17http://puri.sm "The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
>i7-4770HQ haha Intel cant even get rid of binary blobs from their official open source Atom platform (minnowboard). Intel UEFI bios is >100K lines of hand tuned spaghetti code that never saw version control system, thats straight from the mouth of Intel employee.
Actually Intel run EDK2/Tianocore, the open-source "reference implementation" of UEFI. Its core functionality is pretty good quality, but the repo is huge and there's a lot of junk in there. Actual motherboards usually run (closed) forks of it.
Re: Apple EFI Firmware Security Vulnerabilities
#18http://puri.sm "The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
What CPU does it use? Does it need microcode? Interesting thread on exactly how free this laptop is: https://trisquel.info/en/forum/librem-15-freelibre-and-open-... (Edit: This post seems a bit harsh. My view is that any movement towards a more free laptop is welcome, especially since things like Android are going rapidly in the opposite direction)
You just won't get a blobless AMD or Intel computer. Intel for the chipset and CPU, AMD for the GPU firmware.
And ARM is worse, since a majority of the ARM ecosystem just acts like bootloaders and their gpu drivers don't even exist.
Re: Apple EFI Firmware Security Vulnerabilities
#19Can their be an external IO port that is both (a) fast and (b) access limited?
-- BadUSB shows that the USB controller can fake keystrokes, modify the recipient USB controller, etc.
-- This attack now shows an even more dangerous attack that can be mounted by a malicious thunderbolt adapter (the one that you unknowingly connected by habit at a conference, say).
Trammell is giving a longer talk about this work at CCC next week. (http://events.ccc.de/congress/2014/Fahrplan/events/6128.html)
The attack is implemented (he has a demo macbook with "ThunderStruck" bootloader), and it has been disclosed to apple >400 days ago.
One aspect of the attack can be patched with 2-byte change, but apparently apple hasn't bothered.
Re: Apple EFI Firmware Security Vulnerabilities
#20http://puri.sm "The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."
>i7-4770HQ haha Intel cant even get rid of binary blobs from their official open source Atom platform (minnowboard). Intel UEFI bios is >100K lines of hand tuned spaghetti code that never saw version control system, thats straight from the mouth of Intel employee.
I know that legacy BIOS has its issues, but from what I have seen and read, EFI/UEFI is a quagmire.