ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification • Hacker News Board

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#91

Post by ethbro » Sun, Jun 05, 2016, 4:31 PM UTC

Sir_Substance wrote: post #67

brudgers wrote: post #18

Earlier quoted context omitted.

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't c…

That's why this kind of thing needs to be dealt with on a legislative level. Insecure automatic updates need to be met with automatic, unappealable per-day fines calibrated to gobble the margin this kind of behavior creates.

Then hardware manufacturers would just stop shipping updatable software.

Which might be better, but consequences of actions and all that.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#92

Post by PeterisP » Sun, Jun 05, 2016, 4:33 PM UTC

ams6110 wrote: post #58

jamiesonbecker wrote: post #47

Earlier quoted context omitted.

Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.

They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?

The network shouldn't ever be considered appropriately secure - always treat the network as hostile, and install the updates iff you can be sure that you have received the proper data (with appropriate signatures) over the untrusted network.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#93

Post by ygjb » Sun, Jun 05, 2016, 4:33 PM UTC

sleepychu wrote: post #79

kuschku wrote: post #75

Earlier quoted context omitted.

Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.

You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.

Or automate it.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#94

Post by Matthias247 » Sun, Jun 05, 2016, 4:37 PM UTC

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

Most likely: The person who implemented it either did not understand the implications or did not have the knowledge or time to implement HTTPS or other types of signing. And all the other people in the company (including management) don't have any idea of how it should work. There's only a "we can do software updates at all" checkbox ticked somewhere.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#95

Post by dbcurtis » Sun, Jun 05, 2016, 4:39 PM UTC

imglorp wrote: post #73

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

That culture comes from the Darwinian selection of the marketplace.

If you make chips, after you tape out, the design organization must absolutely turn their focus to creating the chip that will obsolete it or someone else will eat your lunch. In a hardware organization, long attention span is a liability, not an asset.

With software, the road to success is incrementally increasing your value to the customer with each successive release. You are in it for the long game, and if you do not have the attention span to achieve a long-term vision, coupled with the ability to deliver incrementally on that vision, you will lose.

Having worked on the software side of a predominantly hardware company, I can tell you first hand how hard it is to get someone whose background is physical chemistry to grok anything to do with user-level software. They have been selected for a short attention span, and are good at their job because of the short attention span. This is at odds with the needs of software product management.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#96

Post by nextos » Sun, Jun 05, 2016, 4:42 PM UTC

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

It also bothers me a lot most manufacturers provide OS-dependent tools for updating UEFI. So if you want to use something as exotic as Linux, you need to keep a bootable partition / USB with Windows somewhere...

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#97

Post by jwcrux » Sun, Jun 05, 2016, 4:43 PM UTC

mtgx wrote: post #8

Didn't Duo Security already expose this? https://duo.com/assets/pdf/out-of-box-exploitation_oem-updat...

Yes, this was one of the 9+ vulns they found.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#98

Post by yrro » Sun, Jun 05, 2016, 4:50 PM UTC

ovt wrote: post #76

wmccullough wrote: post #65

Earlier quoted context omitted.

>It could just be that no one who cares enough about security is in a position to drive that change Bingo, I would also add that it isn't even a matter of caring. I suspect some of these people don't even know that they don't know. Which feeds exactly into your not caring statement. "Never attribute to malice that which is adequately explained by stupidity"

I'm increasingly of the opinion that the never-attribute line is dangerous and damaging.

Hear, hear. If the result is indistinguishable then we should not excuse the incompetent from punishment for the very real damage they cause.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#99

Post by ams6110 » Sun, Jun 05, 2016, 4:53 PM UTC

franciscop wrote: post #82

ams6110 wrote: post #64

Earlier quoted context omitted.

Which is a good reason to always do a fresh OS reinstall before you even boot the system for the first time. That's what I've done the past couple of times I've bought a new PC. the very first boot is off a USB drive to do a clean OS install. Completely wipe the existing disk partitions too.

I couldn't do this, I had to boot windows once to disable UEFI first. Didn't set up the wifi though.

Isn't that just a BIOS setting? Addmitedly I've not dealty with UEFI much.

Re: ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification

#100

Post by UnoriginalGuy » Sun, Jun 05, 2016, 5:03 PM UTC

imglorp wrote: post #73

daxorid wrote: post #7

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is no…

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. An…

Vehicle manufacturers also have this same mindset issue with their in-vehicle entertainment systems. For them things are either a "recall" or they don't exist, they have no concept of software updates or how to deliver them.