We need open source firmware

#1

Post by jernst » Tue, Feb 17, 2015, 6:06 PM UTC

We need open source firmware
upon2020.com

Re: We need open source firmware

#2

Post by greenyoda » Tue, Feb 17, 2015, 6:36 PM UTC

"nobody has ever bought (or not bought) a hard drive because of better firmware."

This may not be true for solid state drives, where the algorithms used in the firmware could significantly affect the performance, reliability and lifetime of the drive.

Re: We need open source firmware

#3

Post by geoelectric » Tue, Feb 17, 2015, 7:11 PM UTC

I'd like to see open source firmware too.

But to the specific argument, wouldn't a reference hash of the blob and/or crypto signing be adequate to verify it's what was delivered?

Re: We need open source firmware

#4

Post by cottonseed » Tue, Feb 17, 2015, 7:28 PM UTC

Wouldn't full-disk encryption mitigate hard drive firmware attacks?

Re: We need open source firmware

#5

Post by jlubawy » Tue, Feb 17, 2015, 7:54 PM UTC

cottonseed wrote: post #4

Wouldn't full-disk encryption mitigate hard drive firmware attacks?

FDE will not help in this case since it only encrypts user data written to the media. However, some of the higher-end HDD models have signed firmware support which renders firmware useless unless it is cryptographically signed by the manufacturer.

Re: We need open source firmware

#6

Post by hga » Tue, Feb 17, 2015, 9:09 PM UTC

greenyoda wrote: post #2

"nobody has ever bought (or not bought) a hard drive because of better firmware." This may not be true for solid state drives, where the algorithms used in the firmware could significantly affect the performance, reliability and lifetime of the drive.

Maybe true in the consumer world, but Western Digital attempted to enter the SCSI enterprise market in the mid-late '90s and I'm told failed because their firmware's write speeds were not competitive compared to Seagate and IBM ... and they ended up buying the latter after it's disk division passed through Hitachi.

Re: We need open source firmware

#7

Post by jernst » Tue, Feb 17, 2015, 9:28 PM UTC

Something verifyable definitely would help, like with a checksum. But then, how do make sure that what you are verifying is actually what is running?

Re: We need open source firmware

#8

Post by cottonseed » Thu, Feb 19, 2015, 10:36 PM UTC

jlubawy wrote: post #5

cottonseed wrote: post #4

Wouldn't full-disk encryption mitigate hard drive firmware attacks?

FDE will not help in this case since it only encrypts user data written to the media. However, some of the higher-end HDD models have signed firmware support which renders firmware useless unless it is cryptographically signed by the manufacturer.

I don't understand this. If you're using FDE, how does the hacked firmware ever escape the drive?