15 ms·
ASUS delivers BIOS/UEFI auto-updates over HTTP with no verification
- grawlinson 10y agoWow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.
- Kubuxu 10y agoWorst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.
- etatoby 10y agoSomeone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS. That should be enough to make them take security seriously (and not really hurt anybody.)
- qb45 10y agoOr with Apple logo, for some extra confusion and hilarity.
- colejohnson66 10y agoSadly, with the current state of the law, you'd be prosecuted for hacking and ASUS goes free. Which is ridiculous.
- qb45 10y agoCould be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)
- egeozcan 10y agoI thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.
- Kubuxu 10y agoI hate this idea as it usually means that you have to run Windows to upgrade BIOS...
- grawlinson 10y agoYou require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...
- qb45 10y agoSolution: buy computers with "generic" motherboards, not OEM boxes. I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup. And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)
- discreditable 10y agoNewer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.
- jamiesonbecker 10y agoIntel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.
- foggarty9 10y ago"HTTP MITM to SYSTEM EXECUTION" ... "+ more" i mean, what else is there?
- tonmoy 10y agoThe irony is that my system would be more secure without ASUS' attempts on updates.
- daxorid 10y agoVery nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is not unique among OEMs) can educate.
- onli 10y agoDon't assume that there is any decision process. Those hardware makers are famous for not getting software. Probably the intern who wrote the downloader did not know who to talk to to get the certificate purchased.
- pfg 10y agoI think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.
- Dagwoodie 10y agoMy AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=123185&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=345&sha=19caefbbd2f0eec2b469e364e001c747758306de https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- icebraining 10y ago
- mtgx 10y agoDidn't Duo Security already expose this? https://duo.com/assets/pdf/out-of-box-exploitation_oem-updaters.pdf https://duo.com/assets/pdf/out-of-box-exploitation_oem-updat...
- raverbashing 10y agoEdit: below is irrelevant, I RTFA and it's even worse than I thought Would it be possible that UEFI does that check (against a built-in signature) instead of relying on HTTPS?
- fauigerzigerk 10y agoAstonishing. Is there any PC maker left that hasn't been found to be grossly negligent or actively malicious?
- fallenshell 10y agoPurism and Apple
- Nullabillity 10y ago> Apple "or actively malicious."
- TazeTSchnitzel 10y agoHow are Apple actively malicious?
- Nullabillity 10y agoLet's see here: * Started the trend of non-replaceable batteries in phones * Started the trend of non-replaceable batteries in laptops * Started the trend of locked-down devices where the owner can't decide what software to run * Custom screws in order to prevent people from fixing their devices * Custom enclosures in order to prevent people from replacing parts in their devices with commodity devices * Soldering in stuff that doesn't need to be And so on, and so forth. It'd be easier to come up with a list of good decisions they've made. In fact, for the sake of balance, here you go:
- prashnts 10y agoRight. These can also be interpret as their reason to make slimmer devices. People buying these products would presumably know what they're getting into.
- rincebrain 10y ago
- philliphaydon 10y agoDamn ASUS that's a real shame, because that Royal Blue Zenbook 3 is god damn sexy https://www.asus.com/Notebooks/ASUS-ZenBook-3-UX390UA/ https://www.asus.com/Notebooks/ASUS-ZenBook-3-UX390UA/
- Bromskloss 10y agoDoesn't it affect only those who run Windows with this ASUS LiveUpdate thing installed? But perhaps you meant that you must now, as a protest, shun ASUS products. I can sympathise with that.
- Nullabillity 10y agoYup. The standard procedure that applies to pretty much any prebuilt computer. If you need to run the stock OS, reformat with the OS vendor's image ASAP, and make sure to only install the minimal driver packages from the hw vendor afterwards.
- philliphaydon 10y agoMy reason for not buying one is because the screen res is small :( I usually reformat them on arrival anyway.
- Bromskloss 10y agoIs the screen matte or glossy?
- vvanders 10y agoThankfully it's trivial to uninstall. My UX390UA didn't have it installed(can't remember if I manually uninstalled it before) and took two seconds to uninstall from second one.
- userbinator 10y agoIronic that your link to the ASUS site is (working) HTTPS. I checked the liveupdate01.asus.com and dlcdnet.asus.com domains referenced in the article, and they can certainly serve over HTTPS...
- graffitici 10y agoOut of curiosity, how would an attacker exploit this to run a code s/he wants? Try to direct the DNS requests to their own server instead of the LiveUpdate one? If so, how? Also, would we be a better design? Hard-code IP addresses to prevent the DNS trick? Use HTTPS and hardcode the public key of the server on every machine? (Only asking out of curiosity, clearly.. Seems like a good case study for designing things right.)
- morsch 10y agoRedirecting DNS is one way; if the attacker can MITM the connection -- e.g. they control the wireless AP, or the router, or the ISP -- they can also just replace the server response with a modified image. Hardcoding the IP is not a good idea and it doesn't work against MITMing. HTTPS with certificate pinning would be the standard way to secure the connection. Verifying the BIOS image using a certificate before installing it is also "a good idea" (ie. pretty much mandatory), that way users can provide a binary downloaded on another computer.
- Retr0spectrum 10y agoARP spoofing on public wifi would be the obvious way.
- ikeboy 10y agohttps://duo.com/blog/out-of-box-exploitation-a-security-analysis-of-oem-updaters https://duo.com/blog/out-of-box-exploitation-a-security-anal... https://duo.com/assets/pdf/out-of-box-exploitation_oem-updaters.pdf https://duo.com/assets/pdf/out-of-box-exploitation_oem-updat... page 15 discusses ASUS.
- franciscop 10y agoThis means I can basically go to a Starbucks and pwn the Asus there, right? I have an Asus now but installed Ubuntu first thing when I got it. If I couldn't use Ubuntu I'd use Mac. I see the problem has two sides, Windows for allowing for malware preinstalled and OEM for installing it.
- qb45 10y agoThings wouldn't be much different if they shipped Ubuntu preinstalled.
- Retr0spectrum 10y agoHow so? It's not my distro of choice, but I'm pretty sure there aren't any known remote root code execution exploits.
- Kubuxu 10y agoIf they wrote and installed remote execution exploit on the Windows they would do the same if they shipped with Ubuntu.
- ams6110 10y agoWhich is a good reason to always do a fresh OS reinstall before you even boot the system for the first time. That's what I've done the past couple of times I've bought a new PC. the very first boot is off a USB drive to do a clean OS install. Completely wipe the existing disk partitions too.
- franciscop 10y agoI couldn't do this, I had to boot windows once to disable UEFI first. Didn't set up the wifi though.
- ams6110 10y ago
- ryao 10y agoPoor security hygiene is by no means unique to Asus' motherboards' firmware updates. You can find bad practices in all sorts of embedded systems' firmware updates. Manual downloads of router firmware are an excellent example of this, and that includes third party OSS firmware such as DD-WRT. The Obihai ATAs will auto-update over HTTP although I have not checked if they do any sort of code signing. I have seen OSS live media that is distributed without PGP signatures, or even HTTPS+checksums. There are plenty of other examples out there. In the case of routers, things are beginning to change because the FCC is requiring that manufacturers prevent users from modifying radio parameters to their satisfaction and the easiest way to do that is to prevent users from using OSS firware: http://hackaday.com/2016/02/26/fcc-locks-down-router-firmware/ http://hackaday.com/2016/02/26/fcc-locks-down-router-firmwar... In the case of Linksys routers, the router firmware appears to also auto-update and until recent firmware versions, it lacked verification. I do not know if it auto-updates over HTTP. If it does, the ones running older firmware would definitely be vulnerable to the same kind of attack as the Asus motherboards. I recently purchased a Linksys EA8500-RB to use as an access point and wanted to flash OSS firmware that I built myself for a reasonable level of confidence in its trustworthiness. It turned out that DD-WRT is the only third party project that supports it at this time. There is no documentation on how to get the precise sources used by the ddwrt developer to build the images he distributes and those downloading them are vulnerable to MITM attacks from the absence of HTTPS+checksums and/or PGP signatures: http://desipro.de/ddwrt/K3-AC-IPQ806X/ http://desipro.de/ddwrt/K3-AC-IPQ806X/ The DD-WRT project does have a subversion repository that could be used, but anyone doing a checkout are vulnerable to a MITM attack due to the absence of HTTPS. A mirror is available on github, although there have no assurance that whatever is replicating the repository from subversion to git is not vulnerable to a MITM attack. Furthermore, the build instructions for the image are missing and while generic instructions exist, they are incomplete. They also specify the use of a binary cross compiler toolchain, which similarly has no obvious source code and no protection against MITM attacks. I built my own toolchain with Gentoo's crossdev, but the incomplete instructions require that I figure out how to use a custom toolchain, the dd-wrt config parameters, the kernel config parameters, how to go from a build to a factory to ddwrt image, etcetera. It is a huge pain, but it is one that I must endure if I want to have an access point running OSS firmware that built myself. Building it myself gives me a high level of assurance that the binaries correspond to the source code and that the source code can be audited by either myself or people in the community. It really should not be that difficult to get trustworthy firmware and Asus' goof is just the tip of the iceberg.
- 45h34jh53k4j 10y agoRoutine updating of Administrator privileged binaries over HTTP is endemic especially by OEMs, and yes, ASUS should know better. I hope this incident will push them towards https for all their http offerings. There really is no excuse anymore, its can be gratis and automated.
- Someone 10y agoI fear that, as a bonus, there is a race condition where a local attacker can replace any update with its own 'update' between download and installation. Worst-case, they might have implemented this like this: DownloadNewUpdatesIntoUpdateDirectory(); ProcessWhateverYouFindInTheUpdateDirectory(); If that's the case, you would only need to copy a payload to that directory.
- Retr0spectrum 10y agoWhile that may be true, I'm not sure if it classifies as a race condition.
- ikeboy 10y agoA local attacker can mitm anyway, no?
- gruez 10y agoNot without administrator permissions
- kogepathic 10y agoLocal to the network. No administrator permissions required, you just have to use your computer in a public place or have a hostile actor on the network (e.g. hotel, cafe)
- Someone 10y ago"Local" to the computer, not the network. If a 'normal' user you can create a file that will get run with administrator privileges, that's equivalent to a UNIX root exploit.
- brudgers 10y agoIt's probably not just ASUS. How the Top Five PC Makers Open Your Laptop to Hackers: https://www.wired.com/2016/05/2036876/ https://www.wired.com/2016/05/2036876/
- hackney 10y agoLook no further than their moniker, Asus ROG (republic of gamers).
- userbinator 10y agoI don't remember the brand(s) exactly --- don't think it was ASUS however --- but I do remember a few years ago of laptops which would automatically and silently download and install BIOS updates, and inevitably some of them would fail, leading to bricked machines. IMHO the BIOS is not something that should ever change unless there's a very important reason to, and even then it should be on the explicit action and consent of the user, because of the risks of ending up with a completely non-working machine. UEFI is a whole new mess, but I think the same principle applies.
- sgeisenh 10y agoASUS has a tendency to have very important reasons to update the BIOS. The last few Intel chipsets, they've had serious BIOS issues at launch that can cause tremendous headaches (random freezes, blue screen, etc.).
- qb45 10y agoIn fact, the last few Intel CPU generations had issues at launch which had to be resolved with BIOS workarounds.
- vetinari 10y agoLast time I update an ASUS BIOS (about a month ago) it was because the board couldn't use a M.2 NVMe SSD at the same time with Intel SATA controller in RAID mode. Who would have thought... Even after update, they work only in CSM mode, forget UEFI.
- carwyn 10y agoAt least one model of ASUS iKVM (server remote management daughter-board) I've seen has an embedded linux OS that doesn't allow changing of the admin password from the default. Doesn't use shadow passwd files either.
- goombastic 10y agoI need a good home firewall device with community based filters now.
- Harry101 10y agoYou may want to do something about the formatting of the XML messages, they seem to be truncated at the moment.
- joliya65 10y agoYou may want to do something about the formatting of the XML messages, they seem to be truncated at the moment.
- deleted 10y ago[deleted]
- nxzero 10y agoEven if the "last mile" is secure, unless the whole process is secure, doesn't matter if the download is secure; case in point, find a oss project that documents their build process to see if security is baked in; hint, of often it is not.
- daveheq 10y agoBut no problems have happened and if there are problems the market will work it out, people will just stop buying Asus, no need to have laws for network security!
- shirro 10y agoThe first thing I did when I got my ASUS UX303UA was re-partition and install Arch Linux. Works flawlessly and I avoid issues with this sort of half baked bloatware. I haven't done any BIOS updates because ASUS doesn't publish detailed changelogs and I don't know if they are required or might cause problems. Excellent hardware company that probably should just stick to hardware. Just an aside, but I have been out of the loop for awhile with Windows but I couldn't believe how ugly Windows 10 looked when I booted it. I currently float between Mac, ChromeOS and Gnome and my favourite at the moment is still the material design look. Windows seems to be getting uglier. It is a shame because, although different, I am not sure it is functionally all that much worse these days.
- ArchD 10y agoIf "unauthorized access" to computer systems without actual damage to said systems were not outlawed, there might be people who would make harmless exploits against such irresponsible vendors and publicly shame them (in the eyes of the general non-techy public) into action. Alas, it's illegal to "exploit" but not illegal for system vendors to enable exploits through negligence. Thus, because of how the law is written, vendors have little incentive to care about security and well-meaning white hats are disincentivized from demonstrating the vendors' irresponsibility.
- bitmadness 10y agoAny suggestions for secure mobos?
- uudecode 10y agoLiveUpdate runs on any OS the purchaser might install, or just Windows? I have never had to perform a BIOS update with any off the shelf computer from ASUS. I have looked at the BIOS updates on offer. I cannot recall that they were always hosted on a server using HTTPS. Or that MD5 signatures were provided. But my understanding was that only users that knew what they were doing applied BIOS updates after purchase. Is flashing the BIOS really common with ordinary users? It's a major change and not something I would want to be done automatically by a third party. This auto-updating craze is becoming a bit farcical. Running programs that let third parties open ports, and run downloaded executables. But the concern is whether someone can MITM or tamper with the download?
- Nullabillity 10y agoOnly Windows, and only if you use the ASUS-provided image or manually install it from their website.
- whyagaindavid 10y agoWhile agree this BIOS update situation is poor, is there any proof a large number of 'common users' are affected by MITM attacks? The average Joe is not doing harbouring any state-secret. This is similar to 'stage-fright'? Please give numbers who got affected? On the other hand, I find people are very relaxed enabling remote desktop or teamviewer (as it promises them to access their file anywhere) and using the same password.
- jokoon 10y agoThat's so dangerous that it can't be a mistake.