Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

181–190 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#181

Post by breakingcups »

deno wrote: post #139
newman314 wrote: post #122

Earlier quoted context omitted.

I've been trying to convince , the owner/(brother of owner) of that desire.de site (btw not the official repo) to implement HTTPS and caching using Let's Encrypt and Cloudflare and not just rely on signed binaries but he's insistent that his method of just signing the binaries is sufficient secure. Maybe if sufficient number of people pester him about it. EDIT: On a related note, I've been trying to get the ddwrt guy…

Transferring signed packages over TLS only prevents the attacker from observing which particular packages are being updated, and that’s assuming the padding alone is sufficient to obscure identification by size. Otherwise signing packages is actually preferred, because you can do it offline, so that hacking the server is not enough to push malicious code.

Not exactly true. If you as a malicious third person can MITM the http connection for updates, you can push an older signed package with known vulnerabilities.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#182

Post by kosmic_k »

Nullabillity wrote: post #80
TazeTSchnitzel wrote: post #48

Earlier quoted context omitted.

How are Apple actively malicious?

Let's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in…

4 out of 6 complaints here all help reduce the size of an electronics product.

In fact some of those decisions led me to chose an Apple product over a non apple one.

Locked down software ended up being a business decision for Apple's App store. As for the screws, I have no idea, but you can easily find appropriate screwdrivers online so it doesn't seem like that big of a deal to me.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#183

Post by whyagaindavid »

While agree this BIOS update situation is poor, is there any proof a large number of 'common users' are affected by MITM attacks? The average Joe is not doing harbouring any state-secret. This is similar to 'stage-fright'? Please give numbers who got affected? On the other hand, I find people are very relaxed enabling remote desktop or teamviewer (as it promises them to access their file anywhere) and using the same password.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#184

Post by Nullabillity »

uudecode wrote: post #178

LiveUpdate runs on any OS the purchaser might install, or just Windows? I have never had to perform a BIOS update with any off the shelf computer from ASUS. I have looked at the BIOS updates on offer. I cannot recall that they were always hosted on a server using HTTPS. Or that MD5 signatures were provided. But my understanding was that only users that knew what they were doing applied BIOS updates after purchase. Is…

Only Windows, and only if you use the ASUS-provided image or manually install it from their website.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#185

Post by merijnv »

bigiain wrote: post #166
matthewaveryusa wrote: post #153

Earlier quoted context omitted.

You sign at the source with a private key, and you verify on the target with the public key. The trick is only someone with the private key can create a signature that the public key can verify.

The other problem is many people wont have pre-existing copies of the required private key available. If your attacker is in a position to MitM your download of a signed binary, they're probably also in a position to MitM your retrieval of the public key. SSL/TLS certainly helps there (at least the attacker then also needs to be capable of acquiring root CA signed TLS certs for the download site and any readily avail…

> The other problem is many people wont have pre-existing copies of the required private key available.

We're talking about software updates, you embed the key INSIDE the software to avoid this problem.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#186

Post by jbk »

breakingcups wrote: post #181
deno wrote: post #139

Earlier quoted context omitted.

Transferring signed packages over TLS only prevents the attacker from observing which particular packages are being updated, and that’s assuming the padding alone is sufficient to obscure identification by size. Otherwise signing packages is actually preferred, because you can do it offline, so that hacking the server is not enough to push malicious code.

Not exactly true. If you as a malicious third person can MITM the http connection for updates, you can push an older signed package with known vulnerabilities.

Only if the installer does not check/warn about downgrades.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#187

Post by Nullabillity »

kosmic_k wrote: post #182
Nullabillity wrote: post #80

Earlier quoted context omitted.

Let's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in…

4 out of 6 complaints here all help reduce the size of an electronics product. In fact some of those decisions led me to chose an Apple product over a non apple one. Locked down software ended up being a business decision for Apple's App store. As for the screws, I have no idea, but you can easily find appropriate screwdrivers online so it doesn't seem like that big of a deal to me.

> Locked down software ended up being a business decision for Apple's App store.

Just as all the others? That's not a defense.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#188

Post by Nullabillity »

TazeTSchnitzel wrote: post #148
Nullabillity wrote: post #80

Earlier quoted context omitted.

Let's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in…

Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile. Also, I should point out that while Apple's phones don't let you install unapproved software, this isn't true of the Mac, which, unlike Microsoft-approved PCs[0], lets you install alternative operating systems (you can even boot to DOS!), disable its security features, etc. [0] I kn…

> Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile.

If they consciously take a hostile action (and let's face it, you don't accidentally design a new screw) then yes, I'd call that malicious. If you do that repeatedly then I'd consider you evil.

> Also, I should point out that while Apple's phones don't let you install unapproved software, this isn't true of the Mac, which, unlike Microsoft-approved PCs[0], lets you install alternative operating systems (you can even boot to DOS!), disable its security features, etc.

Gatekeeper seems like a step towards it. And regardless, Microsoft isn't exactly a paragon to compare yourself against.[0]

[0]: https://www.youtube.com/watch?v=FlcngdW2Ju4

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#189

Post by adam-ff »

newman314 wrote: post #126
userbinator wrote: post #46

Earlier quoted context omitted.

Ironic that your link to the ASUS site is (working) HTTPS. I checked the liveupdate01.asus.com and dlcdnet.asus.com domains referenced in the article, and they can certainly serve over HTTPS...

I wonder if someone has built a transparent proxy/router level implementation of HTTPS Everywhere... That might be quite useful.

That's like mailing a postcard to a company that puts it in an envelope for you.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#190

Post by TazeTSchnitzel »

Nullabillity wrote: post #188
TazeTSchnitzel wrote: post #148

Earlier quoted context omitted.

Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile. Also, I should point out that while Apple's phones don't let you install unapproved software, this isn't true of the Mac, which, unlike Microsoft-approved PCs[0], lets you install alternative operating systems (you can even boot to DOS!), disable its security features, etc. [0] I kn…

> Apple's devices tend to be more difficult to repair or upgrade yourself, yes, but this is not malicious, even if it is somewhat hostile. If they consciously take a hostile action (and let's face it, you don't accidentally design a new screw) then yes, I'd call that malicious. If you do that repeatedly then I'd consider you evil. > Also, I should point out that while Apple's phones don't let you install unapproved s…

Gatekeeper applies only to GUI apps and can be trivially turned off.
Post reply on HN