ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

Post by sgeisenh » Sun, Jun 05, 2016, 4:17 PM UTC

userbinator wrote: post #44

I don't remember the brand(s) exactly --- don't think it was ASUS however --- but I do remember a few years ago of laptops which would automatically and silently download and install BIOS updates, and inevitably some of them would fail, leading to bricked machines. IMHO the BIOS is not something that should ever change unless there's a very important reason to, and even then it should be on the explicit action and co…

Post by pietroalbini » Sun, Jun 05, 2016, 4:18 PM UTC

ams6110 wrote: post #64

Kubuxu wrote: post #40

Earlier quoted context omitted.

If they wrote and installed remote execution exploit on the Windows they would do the same if they shipped with Ubuntu.

Which is a good reason to always do a fresh OS reinstall before you even boot the system for the first time. That's what I've done the past couple of times I've bought a new PC. the very first boot is off a USB drive to do a clean OS install. Completely wipe the existing disk partitions too.

Post by bitJericho » Sun, Jun 05, 2016, 4:19 PM UTC

imglorp wrote: post #73

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Post by kuschku » Sun, Jun 05, 2016, 4:23 PM UTC

johannes1234321 wrote: post #66

homero wrote: post #23

Earlier quoted context omitted.

True but it creates business for ThinkPad and I'm loyal to them. They fupped too though

You mean the Lenovo thinkpads which come with tons of malware like superfish and different insecure plain http update mechanisms?

Post by mattthebaker » Sun, Jun 05, 2016, 4:29 PM UTC

ams6110 wrote: post #55

brudgers wrote: post #18

Earlier quoted context omitted.

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't c…

Except if that were the case, it's even cheaper to not develop a live update capability at all. They went through the process of specifying and developing a automated utility that downloads files, parses manifests and then acts accordingly to install BIOS or other updates, tested it and bundled it with their retail system build, and after all that effort didn't take the one tiny step to sign their files or at least p…