5 ms·

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

by qb45 10y ago

egeozcan 10y ago
I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.
- Kubuxu 10y ago
  I hate this idea as it usually means that you have to run Windows to upgrade BIOS...
  - grawlinson 10y ago
    You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...
    - qb45 10y ago
      Solution: buy computers with "generic" motherboards, not OEM boxes. I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup. And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)
discreditable 10y ago
Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.
- jamiesonbecker 10y ago
  Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.
  - technofiend 10y ago
    Yes it does! Although it doesn't seem to work behind a firewall. LOL. In case direct-from-BIOS flash updates aren't silly enough, imagine having to put your server on the naked internet to boot. No thanks. Even TFTP would be better than that.
  - ams6110 10y ago
    They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?
    - icebraining 10y ago
      You should never trust the network; firmware updates should have to be cryptographically signed and validated against a pinned certificate to be accepted.
    - PeterisP 10y ago
      The network shouldn't ever be considered appropriately secure - always treat the network as hostile, and install the updates iff you can be sure that you have received the proper data (with appropriate signatures) over the untrusted network.
    - rincebrain 10y ago
      The only "good" answer to whether the BMC is supposed to know whether the management network is "secure" would be a song and dance like 802.1x and any authentication configured on top of that, before even allowing you to submit an image for flashing, let alone trying to verify it. (You could argue that the existence of good signature verification on the images is often sufficient, but if you have an older BIOS that's signed but has an exploit vector, you could still make use of that if you had unfettered access other than the signature checking.)
tehrei 10y ago
I am pretty sure that Intel management engine can do that, though obviously it doesn't... Yet
lmz 10y ago
I have a Z77 motherboard that can do that. Not automatically though.
mkhpalm 10y ago
Yeah, thats what the title said to me too. Not the case for me since I don't use any of those windows tools from Asus. (run linux instead on all of them)
yuhong 10y ago
The fun thing is that this is not about the UEFI BIOS binaries itself, which normally must be signed and the signature is checked during UEFI capsule update. The HN title is not exactly correct.

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

by qb45 10y ago

Could be worse, the title made me imagine UEFI firmware itself making HTTP downloads and reflashing itself ;)

I thought that too and then got terrified of the idea that someone trusting an HTTP connection writing (parts of) a damn BIOS. This would be worse than anything. Actually I also don't like BIOS allowing to be flashed from within the OS for convenience. So your computer gets owned and you can't trust your motherboard anymore.

Kubuxu 10y ago
I hate this idea as it usually means that you have to run Windows to upgrade BIOS...
- grawlinson 10y ago
  You require Windows regardless. I have an old HP dm1z that's started playing up with a recent Linux release. Solution? New BIOS firmware. Problem? Can only update via Windows binary. I wish I was joking, but quite a few HP laptops can only be updated via Windows binaries...
  - qb45 10y ago
    Solution: buy computers with "generic" motherboards, not OEM boxes. I have had like 5 different motherboards in the last 10 years and all could be updated from a flash drive with the BIOS setup. And yes, this required user action, they didn't just automatically flash random files from pendrives present during POST ;)

discreditable 10y ago

Newer motherboards with ASUS EZ Flash can do that. I don't think it's automatic though.

jamiesonbecker 10y ago
Intel NUC has an option to directly pull down/install BIOS updates built into UEFI as well, and thus probably other newer Intel boards. Convenience and security are often orthogonal.
- technofiend 10y ago
  Yes it does! Although it doesn't seem to work behind a firewall. LOL. In case direct-from-BIOS flash updates aren't silly enough, imagine having to put your server on the naked internet to boot. No thanks. Even TFTP would be better than that.
- ams6110 10y ago
  They do that so people with hundreds of servers do not have to spend days in the server room with thumb drives, individually booting servers to flash the BIOS. There is HUGE demand for the ability to do remote BIOS updates over a management network. Now how is the BMC supposed to know whether the network is appropriately secure before accepting those updates?
  - icebraining 10y ago
    You should never trust the network; firmware updates should have to be cryptographically signed and validated against a pinned certificate to be accepted.
  - PeterisP 10y ago
    The network shouldn't ever be considered appropriately secure - always treat the network as hostile, and install the updates iff you can be sure that you have received the proper data (with appropriate signatures) over the untrusted network.
  - rincebrain 10y ago
    The only "good" answer to whether the BMC is supposed to know whether the management network is "secure" would be a song and dance like 802.1x and any authentication configured on top of that, before even allowing you to submit an image for flashing, let alone trying to verify it. (You could argue that the existence of good signature verification on the images is often sufficient, but if you have an older BIOS that's signed but has an exploit vector, you could still make use of that if you had unfettered access other than the signature checking.)

tehrei 10y ago

I am pretty sure that Intel management engine can do that, though obviously it doesn't... Yet

lmz 10y ago

I have a Z77 motherboard that can do that. Not automatically though.

mkhpalm 10y ago

Yeah, thats what the title said to me too. Not the case for me since I don't use any of those windows tools from Asus. (run linux instead on all of them)

yuhong 10y ago

The fun thing is that this is not about the UEFI BIOS binaries itself, which normally must be signed and the signature is checked during UEFI capsule update. The HN title is not exactly correct.