8 ms·

Wow. I always knew hardware manufacturers half-assed their software, but this is kind of a new low. I'm not sure whether to laugh or cry.

Kubuxu 10y ago
Worst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.
- etatoby 10y ago
  Someone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS. That should be enough to make them take security seriously (and not really hurt anybody.)
  - qb45 10y ago
    Or with Apple logo, for some extra confusion and hilarity.
  - colejohnson66 10y ago
    Sadly, with the current state of the law, you'd be prosecuted for hacking and ASUS goes free. Which is ridiculous.
qb45 10y ago
Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)
- egeozcan 10y ago
  I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.
  - Kubuxu 10y ago
    I hate this idea as it usually means that you have to run Windows to upgrade BIOS...
    - grawlinson 10y ago
      You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...
      - qb45 10y ago
        Solution: buy computers with "generic" motherboards, not OEM boxes. I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup. And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)
- discreditable 10y ago
  Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.
  - jamiesonbecker 10y ago
    Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.
    - technofiend 10y ago
      Yes it does! Although it doesn't seem to work behind a firewall. LOL. In case direct-from-BIOS flash updates aren't silly enough, imagine having to put your server on the naked internet to boot. No thanks. Even TFTP would be better than that.
    - ams6110 10y ago
      They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?
      - icebraining 10y ago
        You should never trust the network; firmware updates should have to be cryptographically signed and validated against a pinned certificate to be accepted.
      - PeterisP 10y ago
        The network shouldn't ever be considered appropriately secure - always treat the network as hostile, and install the updates iff you can be sure that you have received the proper data (with appropriate signatures) over the untrusted network.
      - 10y ago
- tehrei 10y ago
  I am pretty sure that Intel management engine can do that, though obviously it doesn't... Yet
- lmz 10y ago
  I have a Z77 motherboard that can do that. Not automatically though.
- mkhpalm 10y ago
  Yeah, thats what the title said to me too. Not the case for me since I don't use any of those windows tools from Asus. (run linux instead on all of them)
- yuhong 10y ago
  The fun thing is that this is not about the UEFI BIOS binaries itself, which normally must be signed and the signature is checked during UEFI capsule update. The HN title is not exactly correct.

Kubuxu 10y ago

Worst part is that they didn't even respond to responsible disclosure. I think someone should write a 'virus' that would remove that vulnerable software from users' computers.

etatoby 10y ago
Someone should write a virus that replaces the ASUS logo with Goatse, if the damnable thing really is upgradable from within the OS. That should be enough to make them take security seriously (and not really hurt anybody.)
- qb45 10y ago
  Or with Apple logo, for some extra confusion and hilarity.
- colejohnson66 10y ago
  Sadly, with the current state of the law, you'd be prosecuted for hacking and ASUS goes free. Which is ridiculous.

qb45 10y ago

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

egeozcan 10y ago
I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.
- Kubuxu 10y ago
  I hate this idea as it usually means that you have to run Windows to upgrade BIOS...
  - grawlinson 10y ago
    You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...
    - qb45 10y ago
      Solution: buy computers with "generic" motherboards, not OEM boxes. I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup. And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)
discreditable 10y ago
Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.
- jamiesonbecker 10y ago
  Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.
  - technofiend 10y ago
    Yes it does! Although it doesn't seem to work behind a firewall. LOL. In case direct-from-BIOS flash updates aren't silly enough, imagine having to put your server on the naked internet to boot. No thanks. Even TFTP would be better than that.
  - ams6110 10y ago
    They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?
    - icebraining 10y ago
      You should never trust the network; firmware updates should have to be cryptographically signed and validated against a pinned certificate to be accepted.
    - PeterisP 10y ago
      The network shouldn't ever be considered appropriately secure - always treat the network as hostile, and install the updates iff you can be sure that you have received the proper data (with appropriate signatures) over the untrusted network.
    - 10y ago
tehrei 10y ago
I am pretty sure that Intel management engine can do that, though obviously it doesn't... Yet
lmz 10y ago
I have a Z77 motherboard that can do that. Not automatically though.
mkhpalm 10y ago
Yeah, thats what the title said to me too. Not the case for me since I don't use any of those windows tools from Asus. (run linux instead on all of them)
yuhong 10y ago
The fun thing is that this is not about the UEFI BIOS binaries itself, which normally must be signed and the signature is checked during UEFI capsule update. The HN title is not exactly correct.