ThinkPwn: System Management Mode arbitrary code execution • Hacker News Board

Re: ThinkPwn: System Management Mode arbitrary code execution

#151

Post by makomk » Wed, Jul 06, 2016, 8:22 PM UTC

comex wrote: post #142

driverdan wrote: post #99

Earlier quoted context omitted.

Old, outdated, expensive hardware with low specs? Nope. I have a lot of respect for what they do but it's not the solution we need.

An alternative is to use ARM-based devices: they typically lack microcode updates, and while TrustZone hypervisors are often present and the situation varies by device, at least some devices should allow the user to gain full control of the CPU without having to exploit anything. (I don't know how common that is, because every device manufacturer has their own boot process, and from some quick Google searching it see…

As far as I know anything Allwinner-based lets you run whatever you like with full control of the CPU, probably the same with other Chinese ARM SoCs but there seems to be more of an open source community around Allwinner for some reason. (The other main alternative is Rockchip.)

Re: ThinkPwn: System Management Mode arbitrary code execution

#152

Post by mikejmoffitt » Wed, Jul 06, 2016, 11:08 PM UTC

mkoryak wrote: post #136

Daishiman wrote: post #115

Earlier quoted context omitted.

The sale happened ten years ago and it is extremely unlikely that there are any contractual obligations for this anymore. Let's put this meme to rest; Lenovo has been building solid Thinkpads.

what?! since when? I every single thinkpad I bought since my T43P has been a total piece of shit in comparison. Methinks you have never owned an IBM Thinkpad to make that statement.

The T43p was built by Lenovo. Check the labels on the bottom.

Re: ThinkPwn: System Management Mode arbitrary code execution

#153

Post by __jal » Thu, Jul 07, 2016, 12:39 AM UTC

wyldfire wrote: post #129

__jal wrote: post #87

Earlier quoted context omitted.

Name calling? Come on. I'm not really a fan of the trend of "branding" vulnerabilities, but it is just harmless silliness, and substantially less inflammatory than security industry smack-talking norms from not too long ago. Or put another way, I suggest adjusting your sensitivity before cracking open an issue of Phrack. And a serious question: in your view what would be a "responsible" way to release a multivendor e…

> I'm not really a fan of the trend of "branding" vulnerabilities, but it is just harmless silliness It's probably harmless but I'm not so sure it's silly. It's much more distinguishing than monikers like "CVE-2016-0093". It can sometimes convey the seriousness of the relevant exploit (not sure if that's the case this time though). These branded-vulnerabilities are also probably much more valuable on a CV as such.

Sure. "Silly" is in the eye of the beholder, of course, and I do think successfully executing the "launch" of an exploit is probably a great career move.

I still think it is silly.

I'm less convinced the trend has any use for communicating seriousness. I don't expect product names (basically what this is) to meaningfully convey actionable information in any trustworthy way. But I'll reconsider next time I see a car named "Cheap, mostly-OK vehicle with probable future maintenance headaches" or an exploit named "Smasher of stacks of a little-known utility optionally installed alongside Enterprise Product X, so long as these 7 unlikely preconditions are met".

Re: ThinkPwn: System Management Mode arbitrary code execution

#154

Post by yuhong » Thu, Jul 07, 2016, 7:10 AM UTC

weeks wrote: post #150

yuhong wrote: post #85

Earlier quoted context omitted.

Apple now ships UEFI updates with every version of OS X.

Does Apple use UEFI now? Everything I've read suggests Apple forked at EFI 1.10 and never looked back.

They would have to in order to boot later versions of Windows using UEFI.