ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification • Hacker News Board

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#111

Post by kabdib » Sun, Jun 05, 2016, 5:36 PM UTC

UnoriginalGuy wrote: post #100

imglorp wrote: post #73

Earlier quoted context omitted.

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.

Or, honestly, how to do software. I can crash my Subaru's audio system just by handing it a sufficiently large MP3 file to play. Let's not even go to how bad Bluetooth is. And they will never, ever fix it.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#112

Post by rincebrain » Sun, Jun 05, 2016, 5:38 PM UTC

prashnts wrote: post #108

Nullabillity wrote: post #80

Earlier quoted context omitted.

Let's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in…

Right. These can also be interpret as their reason to make slimmer devices. People buying these products would presumably know what they're getting into.

Custom screws, unless they're customized beyond the driver required to remove them, almost certainly don't qualify as a tool for making slimmer devices.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#113

Post by blkhp19 » Sun, Jun 05, 2016, 5:38 PM UTC

Nullabillity wrote: post #80

TazeTSchnitzel wrote: post #48

Earlier quoted context omitted.

How are Apple actively malicious?

Let's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in…

I'm certain that if you are really honest with yourself, you'll agree that the "malicious" practices you point out are entirely different - not even comparable - to the security negligence pointed out in the OP. When I buy an Apple computer, I'm aware of everything you listed - and in fact, I enjoy it. I don't want to worry about a thing when I buy my computer. I'm not interested in self repairing, upgrading, or tinkering. If I buy an Asus however, I would have had no idea that my entire system was at risk. That kind of negligence is malicious in my eyes - not creating closed off hardware.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#114

Post by spdegabrielle » Sun, Jun 05, 2016, 5:42 PM UTC

icebraining wrote: post #68

Dagwoodie wrote: post #56

Earlier quoted context omitted.

My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cv…

Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. Which is why computer OSs should start treating these as the potential hostile devices they are. None of this "trusted network" nonsense, no unencrypted or unauthenticated connections between devices on the same LAN, etc.

"We have met the enemy and he is us."

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#115

Post by vetinari » Sun, Jun 05, 2016, 5:42 PM UTC

userbinator wrote: post #44

I don't remember the brand(s) exactly --- don't think it was ASUS however --- but I do remember a few years ago of laptops which would automatically and silently download and install BIOS updates, and inevitably some of them would fail, leading to bricked machines. IMHO the BIOS is not something that should ever change unless there's a very important reason to, and even then it should be on the explicit action and co…

Last time I update an ASUS BIOS (about a month ago) it was because the board couldn't use a M.2 NVMe SSD at the same time with Intel SATA controller in RAID mode. Who would have thought... Even after update, they work only in CSM mode, forget UEFI.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#116

Post by yuhong » Sun, Jun 05, 2016, 5:58 PM UTC

dbcurtis wrote: post #95

imglorp wrote: post #73

Earlier quoted context omitted.

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

That culture comes from the Darwinian selection of the marketplace. If you make chips, after you tape out, the design organization must absolutely turn their focus to creating the chip that will obsolete it or someone else will eat your lunch. In a hardware organization, long attention span is a liability, not an asset. With software, the road to success is incrementally increasing your value to the customer with eac…

What is fun is that Intel is still trying to hold OEMs to a one year cycle even as fabrication tech advances are slowing.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#117

Post by yuhong » Sun, Jun 05, 2016, 6:00 PM UTC

qb45 wrote: post #6

grawlinson wrote: post #2

Wow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

The fun thing is that this is not about the UEFI BIOS binaries itself, which normally must be signed and the signature is checked during UEFI capsule update. The HN title is not exactly correct.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#118

Post by JoshTriplett » Sun, Jun 05, 2016, 6:05 PM UTC

jamiesonbecker wrote: post #47

discreditable wrote: post #20

Earlier quoted context omitted.

Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.

Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.

Convenience and security are often closely related: you need regular updates to maintain security, and if it isn't convenient, people won't do it.

As long as the updates handle security properly (use HTTPS and verify signature), I don't see anything wrong with an "update" button in the BIOS.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#119

Post by kuschku » Sun, Jun 05, 2016, 6:12 PM UTC

sleepychu wrote: post #79

kuschku wrote: post #75

Earlier quoted context omitted.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again.

Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#120

Post by nxzero » Sun, Jun 05, 2016, 6:14 PM UTC

Even if the "last mile" is secure, unless the whole process is secure, doesn't matter if the download is secure; case in point, find a oss project that documents their build process to see if security is baked in; hint, of often it is not.