Live data from Hacker News

Damn Vulnerable UEFI

github.com

21–30 of 45 posts

Re: Damn Vulnerable UEFI

#21
post #18

Earlier quoted context omitted.

> How do you build a BIOS successor that's not complicated, when it has to be able to reflash bios from a file on a fat32 partition on a usb stick, because all the other historical ways of reflashing bios were difficult and more fragile? It doesn't need to do this at all. Just make the flash accessible to the OS and have the OS do it. Machines without an OS can be booted into a live image. Put a write-protect jumper…

And when you don't have an OS because you need to update the flash first?

The flash updater IS the OS.

Re: Damn Vulnerable UEFI

#22
post #7

I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.

> It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.

By design. The UEFI is a gigantic NSA backdoor. I've got a bridge to sell to anyone who believes the NSA doesn't own the Microsoft UEFI signing keys, for a start.

Re: Damn Vulnerable UEFI

#23
post #7

I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.

> ...we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction... My initial suspicion was that this was about preparing the ground for closed computing regardless of the surrounding hardware. That this hasn't happened suggests it's just my imagination gone wild, it's a missed opportunity for (say) Microsoft, or the folks behind it had good intentions. Occam's Razor, I guess?

TL;DR UEFI builds an open platform even if the actual code is closed, while "simple" alternatives make closed platforms with open source code.

Raw coreboot/uboot like approaches give you open source but closed platform - the simplicity means you need considerable resources to do something else than the original maker wanted to do with it.

UEFI (and before it, Microsoft attempts at semi-standardizing PC low level interfaces, effort on ACPI, etc) are an effort to provide an open platform no matter the opennes of code, availability of deep dive docs of individual computer models, and handling the fact that computers arez in fact, complex.

If you want a general purpose computer that explicitly targets the idea that it's owner can just plug in CD/USB/netboot a windows/Linux/BSD installer media, without waiting for new release just to have a bootable kernel on s new machine, there's s lot of inherent complexity. Especially if you want to be able to boot a version from before release of the board you're using without significant loss of functionality (something that devicetree cannot do without special explicit work from physical device vendor, but is handled by ACPI through bytecode and _OSI checks for supported capability levels from OS).

Especially if you also want to make it extensible and reduce cost in integrating parts from different vendors (aka why UEFI with hardcoded CSM boot started taking over by 2005).

It's much easier not just to integrate a third party driver for example for network chip when the driver will use well defined interfaces instead of hooking into "boot BASIC from ROM" interrupt, especially when the driver can then expose it's configuration in standard format that will work no matter if you have monitor and mouse connected or just serial port. Petitboot is not the answer - it's way worse when you have to custom rebuild system firmware to add drivers (possibly removing other drivers to make space) because you want to netboot from a network card from different vendor, or just because the hardware is still good but the NIC is younger. Much easier to just grab driver from OpRom or worst case drop it in standardised firmware-accessible partition.

Did I mention how much easier handling booting with UEFI is compared to unholy mess of most other systems? Yes, even GRUB on x86, which by default doesn't write standard compliant boot code so if you dual boot and use certain software packages you end up with nonbootable system. Or how many Linux installers and guides make partitions that only boot because of bug-compatibility in many BIOSes. Not to mention messing with bootsectors Vs "if you drop a compatible filesystem with a file named this way* it will be used for booting".

If I want to play around with booting a late 1960s design where you need to patch binaries if you change something in hardware, I can boot a PDP-10 emulator instead. I push for using UEFI properly because I have work to do and goals to achieve other than tinkering with booting, no matter how much I like tinkering in general

Re: Damn Vulnerable UEFI

#24
post #16

Earlier quoted context omitted.

However each OpenWRT router also has its own custom bootloader AFAIK. This is why you need different images for different devices, and can't create a single image for everything. UEFI on the other hand you just build one image and it works everywhere.

> UEFI on the other hand you just build one image and it works everywhere. Thats the theory. Practice looks like that: https://lore.kernel.org/linux-efi/20200907170021.GA2284449@r... If Vendors couldn't get the BIOS consistently right in the 80ies, why would they get UEFI consistently right now?

Yes, UEFI is messy, not saying you will never have issues. But on the other hand, in OpenWRT you literally need to build an image for each device, something that you (almost) never have to do with UEFI or BIOS. Or when was the last time you had to build a specific image for a x86_64 laptop? If this happened to you, I am curious, this would probably make a nice blog post.

By the way, I am not saying that UEFI is not complicated, but there is probably a middle ground between "we need to build a specific image for this device because its bootloader is dumb" and "we have a f* operational system as a bootloader that works everywhere but is full of holes".

Re: Damn Vulnerable UEFI

#25
post #16

Earlier quoted context omitted.

However each OpenWRT router also has its own custom bootloader AFAIK. This is why you need different images for different devices, and can't create a single image for everything. UEFI on the other hand you just build one image and it works everywhere.

> UEFI on the other hand you just build one image and it works everywhere. Thats the theory. Practice looks like that: https://lore.kernel.org/linux-efi/20200907170021.GA2284449@r... If Vendors couldn't get the BIOS consistently right in the 80ies, why would they get UEFI consistently right now?

That's partly because nesrly nobody, including Linux vendors, actually pushes or checks for parameters being passed from BootVar to executable. Just like barely anyone apparently supports BootVar hotkeys.

Nobody uses it so nobody actually bothers with it, and even Linux defsulted to storing the params in files or kernel itself because good luck finding out you can put them in BootVar at all.

It's still miles better than it was with BIOS, or even Unix workstations (including OpenFirmware ones) with their "emergency releases" of updated OS just to make it boot on new gear

Re: Damn Vulnerable UEFI

#26
post #7

I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.

> It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface. By design. The UEFI is a gigantic NSA backdoor. I've got a bridge to sell to anyone who believes the NSA doesn't own the Microsoft UEFI signing keys, for a start.

It not being a backdoor and NSA stealing UEFI keys from MS aren't exclusive.

To the point that it's Microsoft who mandated a deviation from UEFI SecureBoot spec that enables owners to replace root of trust keys (Platform Key) in UEFI systems if the vendors wants that "designed for windows" sticker.

Re: Damn Vulnerable UEFI

#27
post #2

Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers

At the very least I find it comforting that whenever I need to enter the bios on one of my thinkpad I get a snappy keyboard driven interface that barely changed in 30 years. I'll take that anyday over that slow as hell mouse driven firmware horror Dell and HP have been producing for their servers and laptops.

The nice thing about UEFI is that the build-in "UI framework" means you can get UI from oproms this way as well.

It also means you can bypass the mouse driven monstrosities from at least Dell by booting with console on serial port (for example through IPMI) - and all the same options are available, in vt-100 compatible form.

What relief after finding a server where the base bios was fine, but the intel raid card had its own SVGA+PS/2 mouse requiring setup interface... The mad scramble for a mouse to add to crash cart...

Re: Damn Vulnerable UEFI

#28
post #24

Earlier quoted context omitted.

> UEFI on the other hand you just build one image and it works everywhere. Thats the theory. Practice looks like that: https://lore.kernel.org/linux-efi/20200907170021.GA2284449@r... If Vendors couldn't get the BIOS consistently right in the 80ies, why would they get UEFI consistently right now?

Yes, UEFI is messy, not saying you will never have issues. But on the other hand, in OpenWRT you literally need to build an image for each device, something that you (almost) never have to do with UEFI or BIOS. Or when was the last time you had to build a specific image for a x86_64 laptop? If this happened to you, I am curious, this would probably make a nice blog post. By the way, I am not saying that UEFI is not c…

> Or when was the last time you had to build a specific image for a x86_64 laptop?

iwlwifi firmware blobs..

Re: Damn Vulnerable UEFI

#29
post #23

Earlier quoted context omitted.

> ...we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction... My initial suspicion was that this was about preparing the ground for closed computing regardless of the surrounding hardware. That this hasn't happened suggests it's just my imagination gone wild, it's a missed opportunity for (say) Microsoft, or the folks behind it had good intentions. Occam's Razor, I guess?

TL;DR UEFI builds an open platform even if the actual code is closed, while "simple" alternatives make closed platforms with open source code. Raw coreboot/uboot like approaches give you open source but closed platform - the simplicity means you need considerable resources to do something else than the original maker wanted to do with it. UEFI (and before it, Microsoft attempts at semi-standardizing PC low level inte…

> Did I mention how much easier handling booting with UEFI is compared to unholy mess of most other systems?

Yeah. Like linux entries getting ignored, no eay to debug what went wrong (if an EFI executable fails, you're on your own). A shell which is undocumented. With BIOS i didn't spent hours trying to boot a linux kernel.

Re: Damn Vulnerable UEFI

#30
post #9

Earlier quoted context omitted.

Most, if not all, consumer motherboard manufacturers are Asian themselves (Taiwan)

Sure, but must major BIOS manufacturers, Award, Phoenix, AMI are American AFAIK.

Don't forget the co-inventor of EFI (along with Intel), Insyde...
Post reply on HN