5 ms·

Then you can't do over the wire updates, which means no fixes after it's been manufactured and installed, which would probably increase the costs quite a bit.

WalterBright 10y ago
> Then you can't do over the wire updates, Which, of course, is the whole point. If ROMs do cost more, I bet people who want secure systems would be quite willing to pay a bit extra. It would be too expensive to put an OS in ROM, but the ROMs could contain the hashes of the OS on disk, and can verify the disk image before booting. And besides, why would I want over-the-air updates to my freakin' thermostat?
- WalterBright 10y ago
  Another way is to have a jumper that is required to enable the write cycle to the flash ROMs. That enables the manufacturer to update the ROMs before shipping, then remove the jumper. Anyone trying to compromise the device would then require physical access.
  - mikeash 10y ago
    Make it a button, so the customer can apply updates, but they need to press a button to make it happen. Add another button which, using only software stored in ROM, reloads the firmware from ROM. Then you have updates, but only when the customer knows and wants it, and if they ever screw it up then they can get back to a known good state.
    - WalterBright 10y ago
      Yup, that's the way to do it.
    - Const-me 10y ago
      The customer has no way of knowing whether they are installing genuine update, or MITM-modified malicious update. Public key cryptography solves that but then you have a problem how to protect the keys and crypto algorithms from tampering. Update buttons ain't a good replacement for TPM hardware.
      - mikeash 10y ago
        It's not a panacea, but nothing is, and it would help a lot. It's not supposed to be a replacement for anything, just an addition.
      - WalterBright 10y ago
        It's an enormously harder problem to convince the customer to push the "update firmware" button on the front panel than it is to insert malware remotely without any action or knowledge on the customer's part.
        Const-me 10y ago
        It’s enormously easier problem to exploit a well-known remote code execution vulnerability, that’s unpatched because updates are too easy to ignore. For the end user, it’s extremely easy to NOT push that button.
- kjs3 10y ago
  There are some pretty dense, cheap ROMs out there, certainly 64Mb and I think 128Mb. Nothing as dense as flash, tho. Of course, you can just disable writing of flash memory and get the same result.
jonathankoren 10y ago
This is literally how everything was made until the very recent past. Next you'll be telling me that you can ship software on physical media.
deleted 10y ago
[deleted]
krylon 10y ago
One may consider that an incentive for manufacturers to make sure their code is working correctly before shipping it. In many cases that would probably be prohibitively expensive, but for a thermostat or a light switch, it should not be that difficult to do.
- infinite8s 10y ago
  Are you including the capability to control it over a network? Burning potentially unfixable 0-day exploits into ROM would probably be a non-starter.
  - WalterBright 10y ago
    If you can update the firmware over a network, you have an uncloseable exploit vector. ROMs are not unfixable. They do require physical access, though, which eliminates nearly all of the risk.
    - infinite8s 10y ago
      Even if those updates require signature verification with a public key stored in ROM? I guess the signing key cold get out or you could patch the firmware to skip the signature check (the way the initial iPhone was jailbroken)
      - heavenlyhash 10y ago
        We also literally just had the Windows key leaks within the last week. Un-updatable signing keys are still an uncloseable exploit vector. (And updatable signing keys are an uncloseable exploit vector. You can't win.) Physical-access-only updates: yes please. We know what the security boundary is on those, and how to reset it.
- WalterBright 10y ago
  Prohibitively expensive? That's how things have been done for decades. Only recently have manufacturers decided that everything should be redoable over the internet.

WalterBright 10y ago

> Then you can't do over the wire updates, Which, of course, is the whole point. If ROMs do cost more, I bet people who want secure systems would be quite willing to pay a bit extra. It would be too expensive to put an OS in ROM, but the ROMs could contain the hashes of the OS on disk, and can verify the disk image before booting. And besides, why would I want over-the-air updates to my freakin' thermostat?

WalterBright 10y ago
Another way is to have a jumper that is required to enable the write cycle to the flash ROMs. That enables the manufacturer to update the ROMs before shipping, then remove the jumper. Anyone trying to compromise the device would then require physical access.
- mikeash 10y ago
  Make it a button, so the customer can apply updates, but they need to press a button to make it happen. Add another button which, using only software stored in ROM, reloads the firmware from ROM. Then you have updates, but only when the customer knows and wants it, and if they ever screw it up then they can get back to a known good state.
  - WalterBright 10y ago
    Yup, that's the way to do it.
  - Const-me 10y ago
    The customer has no way of knowing whether they are installing genuine update, or MITM-modified malicious update. Public key cryptography solves that but then you have a problem how to protect the keys and crypto algorithms from tampering. Update buttons ain't a good replacement for TPM hardware.
    - mikeash 10y ago
      It's not a panacea, but nothing is, and it would help a lot. It's not supposed to be a replacement for anything, just an addition.
    - WalterBright 10y ago
      It's an enormously harder problem to convince the customer to push the "update firmware" button on the front panel than it is to insert malware remotely without any action or knowledge on the customer's part.
      - Const-me 10y ago
        It’s enormously easier problem to exploit a well-known remote code execution vulnerability, that’s unpatched because updates are too easy to ignore. For the end user, it’s extremely easy to NOT push that button.
kjs3 10y ago
There are some pretty dense, cheap ROMs out there, certainly 64Mb and I think 128Mb. Nothing as dense as flash, tho. Of course, you can just disable writing of flash memory and get the same result.

jonathankoren 10y ago

This is literally how everything was made until the very recent past. Next you'll be telling me that you can ship software on physical media.

deleted 10y ago

[deleted]

krylon 10y ago

One may consider that an incentive for manufacturers to make sure their code is working correctly before shipping it. In many cases that would probably be prohibitively expensive, but for a thermostat or a light switch, it should not be that difficult to do.

infinite8s 10y ago
Are you including the capability to control it over a network? Burning potentially unfixable 0-day exploits into ROM would probably be a non-starter.
- WalterBright 10y ago
  If you can update the firmware over a network, you have an uncloseable exploit vector. ROMs are not unfixable. They do require physical access, though, which eliminates nearly all of the risk.
  - infinite8s 10y ago
    Even if those updates require signature verification with a public key stored in ROM? I guess the signing key cold get out or you could patch the firmware to skip the signature check (the way the initial iPhone was jailbroken)
    - heavenlyhash 10y ago
      We also literally just had the Windows key leaks within the last week. Un-updatable signing keys are still an uncloseable exploit vector. (And updatable signing keys are an uncloseable exploit vector. You can't win.) Physical-access-only updates: yes please. We know what the security boundary is on those, and how to reset it.
WalterBright 10y ago
Prohibitively expensive? That's how things have been done for decades. Only recently have manufacturers decided that everything should be redoable over the internet.