9 ms·

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in

by daxorid 10y ago

Very nice find. What are the business unit motivations behind critical suppliers like ASUS repeatedly violating customer trust in this manner? At what point in the management chain is the decision reached to sacrifice reputation for - whatever cost savings there are from not implementing TLS/blob signing? edit: This is not rhetorical. Actually curious if someone on HN familiar with this class of companies (ASUS is not unique among OEMs) can educate.

onli 10y ago
Don't assume that there is any decision process. Those hardware makers are famous for not getting software. Probably the intern who wrote the downloader did not know who to talk to to get the certificate purchased.
pfg 10y ago
I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.
- Dagwoodie 10y ago
  My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=123185&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=345&sha=19caefbbd2f0eec2b469e364e001c747758306de https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
  - icebraining 10y ago
    Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. Which is why computer OSs should start treating these as the potential hostile devices they are. None of this "trusted network" nonsense, no unencrypted or unauthenticated connections between devices on the same LAN, etc.
    - spdegabrielle 10y ago
      "We have met the enemy and he is us."
    - snuxoll 10y ago
      Now that IPv6 deployment is getting up there it'd be really nice to see increased use of IPSec. No need to rely on the network that I'm on or the potential that some actor has attempted to MITM a TLS connection (because a lot of people are just going to ignore TLS warnings, unfortunately).
  - bcook 10y ago
    The Asus version of the 2.6.22.19 Linux kernel has many, many backports, so a simple vuln search for vanilla Linux 2.6.22.19 will not yield pertinent results.
    - Raj123123 10y ago
      Fine but many router vendors do not push updates for deployed routers. Majority of ordinary users barely know how to plug in an ethernet cable let alone download&update firmware.
- wmccullough 10y ago
  >It could just be that no one who cares enough about security is in a position to drive that change Bingo, I would also add that it isn't even a matter of caring. I suspect some of these people don't even know that they don't know. Which feeds exactly into your not caring statement. "Never attribute to malice that which is adequately explained by stupidity"
  - ovt 10y ago
    I'm increasingly of the opinion that the never-attribute line is dangerous and damaging.
    - yrro 10y ago
      Hear, hear. If the result is indistinguishable then we should not excuse the incompetent from punishment for the very real damage they cause.
- headShrinker 10y ago
  I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited amount of time I can apply to the demands of the community, 'more security' rarely if ever comes up.
  - heinrich5991 10y ago
    You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.
    - kuschku 10y ago
      Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.
      - sleepychu 10y ago
        You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.
        ygjb 10y ago
        Or automate it.
        kuschku 10y ago
        DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again. Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.
yxhuvud 10y ago
Why do you think they have an agency in and understand their decision? It seems a lot more probable that it is simple incompetence that is the underlying reason.
- _RPM 10y ago
  And Hanlon's razor would agree with you.
brudgers 10y ago
It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't care. "BIOS updates with TLS!" stickers aren't going to improve sales. Buying a laptop creates a consumer not a customer relationship. I want to pay the least, the manufacturer wants to deliver the least. A few years out, shiny-low-cost will drive my next purchase more than brand loyalty.
- homero 10y ago
  True but it creates business for ThinkPad and I'm loyal to them. They fupped too though
  - johannes1234321 10y ago
    You mean the Lenovo thinkpads which come with tons of malware like superfish and different insecure plain http update mechanisms?
    - kuschku 10y ago
      Actually, the ThinkPads never came with that, only IdeaPads, etc. That’s the advantage of using the business line of products: it’s usually not as fucked up.
  - foggarty9 10y ago
    "youre" a small enough amount that they dont care, but other niche companies like system76 will go through the trouble of testing and white labeling a machine
  - brudgers 10y ago
    I'm typing this on a ThinkPad...though it was used and runs Linux and was a Buy it Now $135 including shipping on eBay. And last time I had the new laptop fever (about six months ago) ThinkPads were all I looked at...odds are though I'll buy used again.
imglorp 10y ago
I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. Anything else is fixed overhead which detracts from the R. All those once-s above have moved on to other projects or they were short term contractors anyway.
- bitJericho 10y ago
  And that is the very reason we need to not only push for FOSS, but demand it.
- dbcurtis 10y ago
  That culture comes from the Darwinian selection of the marketplace. If you make chips, after you tape out, the design organization must absolutely turn their focus to creating the chip that will obsolete it or someone else will eat your lunch. In a hardware organization, long attention span is a liability, not an asset. With software, the road to success is incrementally increasing your value to the customer with each successive release. You are in it for the long game, and if you do not have the attention span to achieve a long-term vision, coupled with the ability to deliver incrementally on that vision, you will lose. Having worked on the software side of a predominantly hardware company, I can tell you first hand how hard it is to get someone whose background is physical chemistry to grok anything to do with user-level software. They have been selected for a short attention span, and are good at their job because of the short attention span. This is at odds with the needs of software product management.
  - yuhong 10y ago
    What is fun is that Intel is still trying to hold OEMs to a one year cycle even as fabrication tech advances are slowing.
    - 10y ago
Matthias247 10y ago
Most likely: The person who implemented it either did not understand the implications or did not have the knowledge or time to implement HTTPS or other types of signing. And all the other people in the company (including management) don't have any idea of how it should work. There's only a "we can do software updates at all" checkbox ticked somewhere.
nextos 10y ago
It also bothers me a lot most manufacturers provide OS-dependent tools for updating UEFI. So if you want to use something as exotic as Linux, you need to keep a bootable partition / USB with Windows somewhere...
- ambrosechua 10y ago
  Not all the time. Majority of motherboards, and some laptops, update their UEFI via a USB drive.
superuser2 10y ago
Consumer laptop manufacturers which are not Apple have exactly one game to play: who has the most GHz and GB on the Best Buy shelf for the lowest price? Other dimensions of quality (screen, keyboard, trackpad, hinge, case, battery, fans, overheating issues, preinstalled rootkits and adware, and certainly BIOS) are not relevant to their customers (who, even if they are frustrated with these things, don't necessarily know that something better exists). So they go in whichever direction is cheapest (or, in the case of spyware, brings in the most 3rd party revenue).
Tharre 10y ago
I think you overestimate the actual security impact of this issue. Think about it, practically everyone who is even remotely technical is going to put a fresh copy of his favorite OS on his computer anyway. No one likes dealing with all the bloatware that is installed on those machines by default. And the rest? They're infecting themselves by opening dubious email attachments already. For someone looking to make money through viruses, MitM attacks are just not economical. ASUS really should fix this problem by implementing TLS, but it's just very unlikely that they will lose any amount of customers whatsoever if they don't. And as long as that's the case, nothing will change in that regard.

by daxorid 10y ago

onli 10y ago

Don't assume that there is any decision process. Those hardware makers are famous for not getting software. Probably the intern who wrote the downloader did not know who to talk to to get the certificate purchased.

pfg 10y ago

I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite simply lack any kind of security culture.

Dagwoodie 10y ago
My AC66U runs the linux 2.6.22.19 kernel which has a ton [0] of vulnerabilities in it. Hopefully they back-fix vulnerabilities without updating the kernel version but I doubt it. I would never trust this or any other consumer piece of hardware as a border device considering the sad state they are all in. Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=33&product_id=47&version_id=123185&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=345&sha=19caefbbd2f0eec2b469e364e001c747758306de https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- icebraining 10y ago
  Yet, millions of homes have this or worse sitting as their only gatekeeper into their networks. Which is why computer OSs should start treating these as the potential hostile devices they are. None of this "trusted network" nonsense, no unencrypted or unauthenticated connections between devices on the same LAN, etc.
  - spdegabrielle 10y ago
    "We have met the enemy and he is us."
  - snuxoll 10y ago
    Now that IPv6 deployment is getting up there it'd be really nice to see increased use of IPSec. No need to rely on the network that I'm on or the potential that some actor has attempted to MITM a TLS connection (because a lot of people are just going to ignore TLS warnings, unfortunately).
- bcook 10y ago
  The Asus version of the 2.6.22.19 Linux kernel has many, many backports, so a simple vuln search for vanilla Linux 2.6.22.19 will not yield pertinent results.
  - Raj123123 10y ago
    Fine but many router vendors do not push updates for deployed routers. Majority of ordinary users barely know how to plug in an ethernet cable let alone download&update firmware.
wmccullough 10y ago
>It could just be that no one who cares enough about security is in a position to drive that change Bingo, I would also add that it isn't even a matter of caring. I suspect some of these people don't even know that they don't know. Which feeds exactly into your not caring statement. "Never attribute to malice that which is adequately explained by stupidity"
- ovt 10y ago
  I'm increasingly of the opinion that the never-attribute line is dangerous and damaging.
  - yrro 10y ago
    Hear, hear. If the result is indistinguishable then we should not excuse the incompetent from punishment for the very real damage they cause.
headShrinker 10y ago
I will be honest, I run a small web community of about 20,000 users, so it's different than hardware/firmware updates for potentially mission critical systems... That said, the reason I haven't implemented tighter security practices isn't so much a response to cost-benefit analysis. My users simply haven't made a lot of noise demanding more strict password tolerances, identity verification, or SSL. I have a limited amount of time I can apply to the demands of the community, 'more security' rarely if ever comes up.
- heinrich5991 10y ago
  You should definitely set up SSL/TLS for your web site. Let's Encrypt lets you easily do that.
  - kuschku 10y ago
    Until it decides to completely fuck up your apache webserver config and you have to spend a whole day to properly configure your virtual hosts again. I’ve done it twice, never again.
    - sleepychu 10y ago
      You can do it in certificate only mode. I think DNS challenge is even enabled now so you don't need to let it touch your running server at all. Of course it's a bit of admin every ~90 days but 4 times a year for free SSL isn't bad.
      - ygjb 10y ago
        Or automate it.
      - kuschku 10y ago
        DNS challenge is the worst of both: You have to manually add 60 something DNS entries, and remove them again. Just putting a public key in the DNS and being able to sign a CSR with the correspoding private key should be enough.

yxhuvud 10y ago

Why do you think they have an agency in and understand their decision? It seems a lot more probable that it is simple incompetence that is the underlying reason.

_RPM 10y ago
And Hanlon's razor would agree with you.

brudgers 10y ago

It's hard to make a case for long term support of commodity hardware sold into the consumer market because the most shiny things at the lowest first tends to drive purchases. It's as true for laptops as it is for Android phones. BestBuy doesn't care if it stocks ASUS or not. It cares about sales and margins. If there's an extra dollar putting Gateway on the shelf instead of ASUS they will. And their customers won't care. "BIOS updates with TLS!" stickers aren't going to improve sales. Buying a laptop creates a consumer not a customer relationship. I want to pay the least, the manufacturer wants to deliver the least. A few years out, shiny-low-cost will drive my next purchase more than brand loyalty.

homero 10y ago
True but it creates business for ThinkPad and I'm loyal to them. They fupped too though
- johannes1234321 10y ago
  You mean the Lenovo thinkpads which come with tons of malware like superfish and different insecure plain http update mechanisms?
  - kuschku 10y ago
    Actually, the ThinkPads never came with that, only IdeaPads, etc. That’s the advantage of using the business line of products: it’s usually not as fucked up.
- foggarty9 10y ago
  "youre" a small enough amount that they dont care, but other niche companies like system76 will go through the trouble of testing and white labeling a machine
- brudgers 10y ago
  I'm typing this on a ThinkPad...though it was used and runs Linux and was a Buy it Now $135 including shipping on eBay. And last time I had the new laptop fever (about six months ago) ThinkPads were all I looked at...odds are though I'll buy used again.

imglorp 10y ago

I find there's a pervasive hardware culture that's at odds with both software and security cultures. Hardware culture involves designing it once, testing it once, setting up the supply chain and production line once, and from then on it's just quality control and marketing: totally a fire-and-forget weapon. That means in a hardware dominated organization, where you sell hardware, revenue is in terms of units sold. Anything else is fixed overhead which detracts from the R. All those once-s above have moved on to other projects or they were short term contractors anyway.

bitJericho 10y ago
And that is the very reason we need to not only push for FOSS, but demand it.
dbcurtis 10y ago
That culture comes from the Darwinian selection of the marketplace. If you make chips, after you tape out, the design organization must absolutely turn their focus to creating the chip that will obsolete it or someone else will eat your lunch. In a hardware organization, long attention span is a liability, not an asset. With software, the road to success is incrementally increasing your value to the customer with each successive release. You are in it for the long game, and if you do not have the attention span to achieve a long-term vision, coupled with the ability to deliver incrementally on that vision, you will lose. Having worked on the software side of a predominantly hardware company, I can tell you first hand how hard it is to get someone whose background is physical chemistry to grok anything to do with user-level software. They have been selected for a short attention span, and are good at their job because of the short attention span. This is at odds with the needs of software product management.
- yuhong 10y ago
  What is fun is that Intel is still trying to hold OEMs to a one year cycle even as fabrication tech advances are slowing.
  - 10y ago

Matthias247 10y ago

Most likely: The person who implemented it either did not understand the implications or did not have the knowledge or time to implement HTTPS or other types of signing. And all the other people in the company (including management) don't have any idea of how it should work. There's only a "we can do software updates at all" checkbox ticked somewhere.

nextos 10y ago

It also bothers me a lot most manufacturers provide OS-dependent tools for updating UEFI. So if you want to use something as exotic as Linux, you need to keep a bootable partition / USB with Windows somewhere...

ambrosechua 10y ago
Not all the time. Majority of motherboards, and some laptops, update their UEFI via a USB drive.

superuser2 10y ago

Consumer laptop manufacturers which are not Apple have exactly one game to play: who has the most GHz and GB on the Best Buy shelf for the lowest price? Other dimensions of quality (screen, keyboard, trackpad, hinge, case, battery, fans, overheating issues, preinstalled rootkits and adware, and certainly BIOS) are not relevant to their customers (who, even if they are frustrated with these things, don't necessarily know that something better exists). So they go in whichever direction is cheapest (or, in the case of spyware, brings in the most 3rd party revenue).

Tharre 10y ago

I think you overestimate the actual security impact of this issue. Think about it, practically everyone who is even remotely technical is going to put a fresh copy of his favorite OS on his computer anyway. No one likes dealing with all the bloatware that is installed on those machines by default. And the rest? They're infecting themselves by opening dubious email attachments already. For someone looking to make money through viruses, MitM attacks are just not economical. ASUS really should fix this problem by implementing TLS, but it's just very unlikely that they will lose any amount of customers whatsoever if they don't. And as long as that's the case, nothing will change in that regard.