5 ms·

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

by dhimes 10y ago

voltagex_ 10y ago
Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.
- deleted 10y ago
  [deleted]
- Zardoz84 10y ago
  I'm begin to think that EFI is a very wrong turn way on modern computers.
  - Sir_Cmpwn 10y ago
    You're a bit behind the curve on this. EFI has been criticized for being horrendously complicated and gross since its inception.
    - semi-extrinsic 10y ago
      Obligatory Matthew Garrett quote from a Linux kernel EFI patch in 2011: UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" is an ancient African word meaning "Why do something right when you can do it so wrong that children will weep and brave adults will cower before you", and "UEI" is Celtic for "We missed DOS so we burned it into your ROMs". https://lkml.org/lkml/2011/5/25/228 https://lkml.org/lkml/2011/5/25/228
      - yuhong 10y ago
        Even on servers, I noticed that HP (now HPE) began locking access to server UEFI updates soon after http://lkml.org/lkml/2013/11/11/653 http://lkml.org/lkml/2013/11/11/653 was posted.
  - digi_owl 10y ago
    The PC platform as a whole is going through a severe case of "second system effect".
    - yuhong 10y ago
      Even back in the 1990s, there was ACPI. ACPI 1.0 for example dates back to the end of 1996 (of course before then there was drafts): http://uefi.org/sites/default/files/resources/ACPI_1.pdf http://uefi.org/sites/default/files/resources/ACPI_1.pdf But of course ACPI took years to catch on, during which low cost PCs from for example eMachines was coming.
      - digi_owl 10y ago
        I seem to recall Torvalds having some less than kind words about ACPI.
        yuhong 10y ago
        I know. In fact, there is a reason I wonder what would have happened if Intel bought Compaq back in 1991 with Rod Canion and Jim Harris staying on.
- yuhong 10y ago
  I think you can easily do some of the UEFI DoS attacks directly from Windows without executing an EFI binary.
- dogma1138 10y ago
  Every desktop motherboard comes with a legacy bios, and virtually all of them come with a bios flashback USB port that can be used even without a CPU (it's used in cases where you fucked up the system completely, or you have a CPU which requires a newer bios). Laptops are another story.
kuschku 10y ago
And all of it just because they didn’t have a Windows 10 VM. Would’ve been funny to see what they’d have done with EFI – maybe a graphical message? Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.
- Kadin 10y ago
  > Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today. It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly become conditioned to click through the warnings. I'll be honest: if there was an app that I wanted to install, and I got an unsigned-package warning, my first thought on both Mac and Windows would be that the developer probably had an ethical or financial problem with the signing scheme, not that the package was compromised. On Linux, I'd be more confident and probably stop what I was doing, but only because very little software makes it onto distribution systems if the developer has an issue with the platform...
  - snuxoll 10y ago
    It helps that signing packages for Linux distributions costs $0, since they all use GPG. I actively avoid adding repositories that aren't signed with GPG keys for this reason, though it still doesn't protect me from compromised keypairs.
  - ambrop7 10y ago
    I usually check the hashes of all software I download. How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google it. If you find what look like legitimate hits associating this file with this hash, call it good. And it does work in this case - try googling both the published good and bad hash :)
    - 10y ago

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

by dhimes 10y ago

From their Twitter page Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded.

voltagex_ 10y ago

Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.

deleted 10y ago
[deleted]
Zardoz84 10y ago
I'm begin to think that EFI is a very wrong turn way on modern computers.
- Sir_Cmpwn 10y ago
  You're a bit behind the curve on this. EFI has been criticized for being horrendously complicated and gross since its inception.
  - semi-extrinsic 10y ago
    Obligatory Matthew Garrett quote from a Linux kernel EFI patch in 2011: UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" is an ancient African word meaning "Why do something right when you can do it so wrong that children will weep and brave adults will cower before you", and "UEI" is Celtic for "We missed DOS so we burned it into your ROMs". https://lkml.org/lkml/2011/5/25/228 https://lkml.org/lkml/2011/5/25/228
    - yuhong 10y ago
      Even on servers, I noticed that HP (now HPE) began locking access to server UEFI updates soon after http://lkml.org/lkml/2013/11/11/653 http://lkml.org/lkml/2013/11/11/653 was posted.
- digi_owl 10y ago
  The PC platform as a whole is going through a severe case of "second system effect".
  - yuhong 10y ago
    Even back in the 1990s, there was ACPI. ACPI 1.0 for example dates back to the end of 1996 (of course before then there was drafts): http://uefi.org/sites/default/files/resources/ACPI_1.pdf http://uefi.org/sites/default/files/resources/ACPI_1.pdf But of course ACPI took years to catch on, during which low cost PCs from for example eMachines was coming.
    - digi_owl 10y ago
      I seem to recall Torvalds having some less than kind words about ACPI.
      - yuhong 10y ago
        I know. In fact, there is a reason I wonder what would have happened if Intel bought Compaq back in 1991 with Rod Canion and Jim Harris staying on.
yuhong 10y ago
I think you can easily do some of the UEFI DoS attacks directly from Windows without executing an EFI binary.
dogma1138 10y ago
Every desktop motherboard comes with a legacy bios, and virtually all of them come with a bios flashback USB port that can be used even without a CPU (it's used in cases where you fucked up the system completely, or you have a CPU which requires a newer bios). Laptops are another story.

kuschku 10y ago

And all of it just because they didn’t have a Windows 10 VM. Would’ve been funny to see what they’d have done with EFI – maybe a graphical message? Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today.

Kadin 10y ago
> Anyway, the only way to solve these issues in the long-term is with relying more on signed software, similar to how Linux repos work already today. It seemed as though Windows was warning the users that the software was unsigned; they just clicked through it. That's a different problem -- it's entirely possible to have a signing system, but if enough developers hate and refuse to use it, then users will quickly become conditioned to click through the warnings. I'll be honest: if there was an app that I wanted to install, and I got an unsigned-package warning, my first thought on both Mac and Windows would be that the developer probably had an ethical or financial problem with the signing scheme, not that the package was compromised. On Linux, I'd be more confident and probably stop what I was doing, but only because very little software makes it onto distribution systems if the developer has an issue with the platform...
- snuxoll 10y ago
  It helps that signing packages for Linux distributions costs $0, since they all use GPG. I actively avoid adding repositories that aren't signed with GPG keys for this reason, though it still doesn't protect me from compromised keypairs.
- ambrop7 10y ago
  I usually check the hashes of all software I download. How do I check the hash if the vendor doesn't publish it, you might ask? Simple, calculate it and Google it. If you find what look like legitimate hits associating this file with this hash, call it good. And it does work in this case - try googling both the published good and bad hash :)
  - 10y ago