4 ms·
> disabling user-loading of new firmware Am I understanding correctly that these devices can never have their firmware updated? That there is no update mechani
by discreditable 10y ago
> disabling user-loading of new firmware
Am I understanding correctly that these devices can never have their firmware updated? That there is no update mechanism seems insane. They could prevent bad firmware updates by wiping keys on upgrade. The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever.
- pfg 10y ago> The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever. This happened last year and they offered free replacements for affected users[1]. [1]: https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-bug/ https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-...
- davideous 10y ago> They could prevent bad firmware updates by wiping keys on upgrade This does not close the attack vector of someone intercepting the device before you get it and surreptitiously installing firmware with a backdoor.
- discreditable 10y agoHow do they do that to begin with?
- jacobush 10y agoModify the hardware to look the same but with added features. Like a radio transmitter.
- e12e 10y agoThere's been various news on this, like (first Google search I came across): http://www.geek.com/news/nsas-top-hacking-unit-intercepts-mail-order-electronics-can-get-the-ungettable-1561691/ http://www.geek.com/news/nsas-top-hacking-unit-intercepts-ma...
- mpeg 10y agoAnd then you are fucked because you can't update the firmware to the trusted, signed open source version.