Damn Vulnerable UEFI
github.com
Damn Vulnerable UEFI
1–10 of 45 posts
Re: Damn Vulnerable UEFI
#2Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
Re: Damn Vulnerable UEFI
#3Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
Be careful what you wish for, as the overwhelming purpose of discovered exploits will be to give freedom to the rightful owners of devices.
Re: Damn Vulnerable UEFI
#4I had a chuckle when I saw "Challenge 1: Singing Binaries" [0]
[0] https://github.com/hacking-support/DVUEFI/tree/main/docs/2-s...
Re: Damn Vulnerable UEFI
#5Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
> Or break up the damn covert cabal that’s the 3 major bios producers
I'm curious about that - why isn't there more competition, especially when everything you need to do it without them is easily available online? Like, not just specs, all the actual code you'd need is open source and AIUI friendly to use. Frankly, why aren't most motherboards shipping with lightly-patched coreboot+edk2?
Re: Damn Vulnerable UEFI
#6Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
> Or break up the damn covert cabal that’s the 3 major bios producers I'm curious about that - why isn't there more competition, especially when everything you need to do it without them is easily available online? Like, not just specs, all the actual code you'd need is open source and AIUI friendly to use. Frankly, why aren't most motherboards shipping with lightly-patched coreboot+edk2?
>I'm curious about that - why isn't there more competition
Because like most consumer PC parts, it's a race to the bottom low margin low wage business, usually offshored to Asia, that's only remotely profitable for the top 2-3 players who captured the market and optimized the costs, processes, development and supply chain to the max.
Why would anyone else want to enter such a market to compete for even lower profits?
Re: Damn Vulnerable UEFI
#7I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal.
Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.
Re: Damn Vulnerable UEFI
#8Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
At the very least I find it comforting that whenever I need to enter the bios on one of my thinkpad I get a snappy keyboard driven interface that barely changed in 30 years.
I'll take that anyday over that slow as hell mouse driven firmware horror Dell and HP have been producing for their servers and laptops.
Re: Damn Vulnerable UEFI
#9Earlier quoted context omitted.
> Or break up the damn covert cabal that’s the 3 major bios producers I'm curious about that - why isn't there more competition, especially when everything you need to do it without them is easily available online? Like, not just specs, all the actual code you'd need is open source and AIUI friendly to use. Frankly, why aren't most motherboards shipping with lightly-patched coreboot+edk2?
>I'm curious about that - why isn't there more competition Because like most consumer PC parts, it's a race to the bottom low margin low wage business, usually offshored to Asia, that's only remotely profitable for the top 2-3 players who captured the market and optimized the costs, processes, development and supply chain to the max. Why would anyone else want to enter such a market to compete for even lower profits?
Most, if not all, consumer motherboard manufacturers are Asian themselves (Taiwan)
Re: Damn Vulnerable UEFI
#10I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.
How do you build a BIOS successor that's not complicated, when it has to be able to reflash bios from a file on a fat32 partition on a usb stick, because all the other historical ways of reflashing bios were difficult and more fragile? How do you build a BIOS successor that's not complicated when it needs to allow an OS to alter boot settings for the next boot?
Granted, most of what goes on in a BIOS is displaying and changing variables involved in getting the system running, and maintaining those values, which just requires some sort of minimal editing interface and nv storage, but then... users appear. They want to be able to use a mouse. They want an ability to configure their raid chipset prior to boot, or netboot, and HW makers want to implement that in a way that's not some arcane raw assembly dance between BIOS and additional chip FW. What then?
I don't think the complaint is about complexity, but about code quality and architecture. This isn't the only case where an old, simpler but less capable and annoying, system has been replaced by a much more complex system that is much hated and [initially] buggy and less secure, but also more or less gets the job done better than the old way, and where average users of the new system find it easier and more productive.
If there wasn't a case where a hardware manufacturer needed a capability prior to the OS taking over, or to modify their HW settings from the OS in a portable way, it wouldn't be in UEFI, right?
Calling UEFI a full operating system seems needlessly inflammatory. It's not a linux or windows kernel. It has to do a fair amount of the basics, but so does any kernel running on a general purpose chip and interfacing with a bunch of other people's code. UEFI is terrible. Baseband firmwares are terrible. Security processor firmwares are terrible. AMT is terrible. Okay, but we still need them.