5 ms·
Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue. A few i
by fencepost 10y ago
Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue.
A few important notes from the article and the releaser's blog post:
* This is not a Lenovo problem so much as a problem for multiple vendors who used BIOS based on Intel's reference information. The original problem was with source code provided by Intel. The same problem is confirmed to exist in at least one HP system.
* This was apparently fixed back in 2014, but there doesn't seem to be an indication that it was recognized as a security flaw then or at least it wasn't noted as a security fix. 2014 isn't that long ago in terms of propagating BIOS updates.
* Cr4sh apparently decided to just release, "I decided to do the full disclosure because the main goal of my UEFI series articles is to share the knowledge, not to make vendors and their users happy."
* His assessment is "It’s very unlikely that this vulnerability will be exploited in the wild, for regular customers there are much more chances to be killed with the lightning strike than meet any System Management Mode exploit or malware."
- CaptSpify 10y agoAlthough you are correct, I don't feel it's bad to blame the vendor who was running code that they didn't know the source of, nor the reasoning behind it's existence.
- kuschku 10y agoSo, literally every vendor? Can you think of a single example of a vendor not running UEFI code from others, not running either Qualcomm's kernels for ARM chips, nor distributing Intel's ME firmaware, nor distributing AMD's TPM firmware? I don't think there's a single OEM that knows what they're actually running – if there is, SAMSUNG would likely be it, because they have a chance at actually doing everything in-house.
- drewg123 10y agoI thought that Chromebooks, at least, run coreboot rather than UEFI, and so should be immune from this.
- skykooler 10y agoProbably Apple, too - they prefer to implement things in-house wherever possible.
- narrator 10y agoI wonder what command and control systems that ship with Russian and Chinese military equipment use.
- CaptSpify 10y agoCorrect. Just because everyone does it, doesn't mean it's OK to do. "If everyone jumped off of a bridge..."
- Asooka 10y agoIf everyone jumped off a bridge, the bridge is probably on fire, or the several decades of airtime has a higher ROI than the bridge and if by some miracle you actually start getting close to the water, you always have your golden parachute.
- nitemice 10y agohttps://xkcd.com/1170/ https://xkcd.com/1170/
- devy 10y agoIt's only been a few days since disclosure. No PC manufacturers these days knows every single line of code they get from their vendors - if they did, there wouldn't need to outsource it in the first place.
- CaptSpify 10y agoYou are correct, but that still doesn't make it right.
- devy 10y agoPerhaps financial compensation was indeed not Cr4sh's motivation for this zero day, but I felt it's a stretch to call this disclosure responsible. Also his name-calling (ThinkPwn) campaign was inappropriate and premature when the root cause was later discovered in Intel's reference code and propagated to IBVs's products.
- __jal 10y agoName calling? Come on. I'm not really a fan of the trend of "branding" vulnerabilities, but it is just harmless silliness, and substantially less inflammatory than security industry smack-talking norms from not too long ago. Or put another way, I suggest adjusting your sensitivity before cracking open an issue of Phrack. And a serious question: in your view what would be a "responsible" way to release a multivendor exploit? Please describe the preconditions which would need to be met before you'd use the adjective.
- devy 10y agoGive the vendor a timeframe to investigate and resolve. Even sometimes ignores reports like this, at least give them the courtesy instead of expose this as an 0day.
- geocar 10y agoWhy? Lenovo put users at risk and public shaming is a tool to correct their behaviour. Lenovo could allow users to replace software on their machine, but presently choose not to because they might make less money. However if Lenovo are shamed, people might buy less of Lenovo's products, which will also make Lenovo less money.
- __jal 10y agoMy mistake - I had developed the impression that Lenovo was informed ahead of time. I had only skimmed at first. I had thought the complaint was about not waiting until what sounds like most of the PC OEMs stopped sitting on their thumbs. Please disregard that part of my response.
- 10y ago
- yuhong 10y agoMy personal favorite is the UEFI variable bugs that brick laptops. I think many of them are trivial to exploit even under Windows.
- geofft 10y agoDon't you need root access for those? They're awful bugs, yes, but being able to semi-permanently brick a laptop from privileged userspace isn't super surprising. If you can reflash the firmware without the firmware checking signatures on updates, you're done.
- yuhong 10y agoIt is trivial for any malware to do though, without even needing a kernel driver. I can see ransomware trying for example.