Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

51–60 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#51

Post by icu »

ryao wrote: post #28

Poor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS liv…

Thanks for posting this comment. Is there any way you could write a detailed how to blog post going over this project?

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#52

Post by etatoby »

Kubuxu wrote: post #3
grawlinson wrote: post #2

Wow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.

Worst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.

Someone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS.

That should be enough to make them take security seriously (and not really hurt anybody.)

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#53

Post by gruez »

ikeboy wrote: post #38
Someone wrote: post #33

I fear that, as a bonus, there is a race condition where a local attacker can replace any update with its own 'update' between download and installation. Worst-case, they might have implemented this like this: DownloadNewUpdatesIntoUpdateDirectory(); ProcessWhateverYouFindInTheUpdateDirectory(); If that's the case, you would only need to copy a payload to that directory.

A local attacker can mitm anyway, no?

Not without administrator permissions

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#54

Post by vvanders »

Bromskloss wrote: post #24
philliphaydon wrote: post #17

Damn ASUS that's a real shame, because that Royal Blue Zenbook 3 is god damn sexy https://www.asus.com/Notebooks/ASUS-ZenBook-3-UX390UA/

Doesn't it affect only those who run Windows with this ASUS LiveUpdate thing installed? But perhaps you meant that you must now, as a protest, shun ASUS products. I can sympathise with that.

Thankfully it's trivial to uninstall. My UX390UA didn't have it installed(can't remember if I manually uninstalled it before) and took two seconds to uninstall from second one.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#55

Post by ams6110 »

brudgers wrote: post #18
daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't c…

Except if that were the case, it's even cheaper to not develop a live update capability at all.

They went through the process of specifying and developing a automated utility that downloads files, parses manifests and then acts accordingly to install BIOS or other updates, tested it and bundled it with their retail system build, and after all that effort didn't take the one tiny step to sign their files or at least put a $10 TLS certificated on their servers?

To me the more likely answer is that (as observed) this dates back to XP days or even earlier, when securing this sort of stuff was not front-of-mind. Back then, finding downloadable software served over https was rare. ftp or http was far more likely. And I think ASUS just never thought about updating their tools. They worked, so never really got a thorough second look at any point up until today.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#56

Post by Dagwoodie »

pfg wrote: post #10
daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks.

[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#57

Post by technofiend »

jamiesonbecker wrote: post #47
discreditable wrote: post #20

Earlier quoted context omitted.

Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.

Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.

Yes it does! Although it doesn't seem to work behind a firewall. LOL. In case direct-from-BIOS flash updates aren't silly enough, imagine having to put your server on the naked internet to boot. No thanks. Even TFTP would be better than that.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#58

Post by ams6110 »

jamiesonbecker wrote: post #47
discreditable wrote: post #20

Earlier quoted context omitted.

Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.

Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.

They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?
Post reply on HN