Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

teletext.zaibatsutel.net

Post reply on HN
Print view View original

71–80 of 200 posts

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#71

Post by icebraining »

ams6110 wrote: post #58
jamiesonbecker wrote: post #47

Earlier quoted context omitted.

Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.

They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?

You should never trust the network; firmware updates should have to be cryptographically signed and validated against a pinned certificate to be accepted.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#72

Post by heinrich5991 »

headShrinker wrote: post #69
pfg wrote: post #10

Earlier quoted context omitted.

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited a…

You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#73

Post by imglorp »

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

I find there's a pervasive hardware culture that's at odds with both software and security cultures.

Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon.

That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. Anything else is fixed overhead which detracts from the R. All those once-s above have moved on to other projects or they were short term contractors anyway.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#74

Post by bcook »

Dagwoodie wrote: post #56
pfg wrote: post #10

Earlier quoted context omitted.

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cv…

The Asus version of the 2.6.22.19 Linux kernel has many, many backports, so a simple vuln search for vanilla Linux 2.6.22.19 will not yield pertinent results.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#75

Post by kuschku »

heinrich5991 wrote: post #72
headShrinker wrote: post #69

Earlier quoted context omitted.

I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited a…

You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again.

I’ve done it twice, never again.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#76

Post by ovt »

wmccullough wrote: post #65
pfg wrote: post #10

Earlier quoted context omitted.

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

>It could just be that no one who cares enough about security is in a position to drive that change Bingo, I would also add that it isn't even a matter of caring. I suspect some of these people don't even know that they don't know. Which feeds exactly into your not caring statement. "Never attribute to malice that which is adequately explained by stupidity"

I'm increasingly of the opinion that the never-attribute line is dangerous and damaging.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#77

Post by goodplay »

headShrinker wrote: post #69
pfg wrote: post #10

Earlier quoted context omitted.

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited a…

Odds are that I'm not from your community, but I follow a personal policy of not visiting plain http websites. I have strict HTTPS enabled at all times, and for the few sites that I visit that exclusively serve insecure content, I visit through archive.org or google cache.

Needless to say, I can't interact with these sites through proxies. It could also be the case that those who care about their security and privacy simply left your community or limited their presence to just being spectators.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#79

Post by sleepychu »

kuschku wrote: post #75
heinrich5991 wrote: post #72

Earlier quoted context omitted.

You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#80

Post by Nullabillity »

TazeTSchnitzel wrote: post #48
Nullabillity wrote: post #35

Earlier quoted context omitted.

> Apple "or actively malicious."

How are Apple actively malicious?

Let's see here:

* Started the trend of non-replaceable batteries in phones

* Started the trend of non-replaceable batteries in laptops

* Started the trend of locked-down devices where the owner can't decide what software to run

* Custom screws in order to prevent people from fixing their devices

* Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices

* Soldering in stuff that doesn't need to be

And so on, and so forth. It'd be easier to come up with a list of good decisions they've made. In fact, for the sake of balance, here you go:

Post reply on HN