4 ms·

> System76 will automatically deliver updated firmware with a disabled ME Having the ability to automatically push new firmware of your own creation to custome

> System76 will automatically deliver updated firmware with a disabled ME Having the ability to automatically push new firmware of your own creation to customers' machines is more power than you ought to want. My security threat model as a System76 customer shouldn't have to include you (perhaps with you being hacked or coerced) pushing me malware that's undetectable to my OS after it's been installed. Please reconsider this feature (of automatic firmware updates). Firmware updates are rare enough that it should be fine for them to be explicitly opt-in. It's great to want to make Intel's firmware more secure. But replacing Intel as a possible attack vector with yourselves is strictly worse for the machine's security.

cassidyjames 9y ago
System76 employee here. I suppose the "automatic" could be re-worded; the data is automatically pushed to the machine but then the user always opts into the actual install. But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place. These updates are signed and verified with industry best practices. jackpot51 (the System76 engineer currently working on this) could probably detail it better than I can, though.
- mulmen 9y ago
  Is the user intervention required to install the firmware or do you still have the capability to install it without asking? Just because you ask for permission now does not mean that you have to. Why push the firmware before asking?
  - cassidyjames 9y ago
    I asked David Jordan, the engineer working on the firmware updater. >Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code. The code is available at https://github.com/pop-os/system76-driver https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update https://github.com/system76/firmware-update
    - mulmen 9y ago
      Thanks for the reply! So you can push an update to the python code that allows you to push an update to the firmware without prompting? Sounds like we still rely on the security of your systems to prevent malicious firmware from being pushed.
      - yjftsjthsd-h 9y ago
        Well... yeah? They're the OS vendor; there is literally no way for them to do their job without having the ability to update the system.
        mulmen 9y ago
        Yes they have to be able to update the system but in this case they are also able to update the firmware without asking which means anyone who can impersonate or coerce them can also update the firmware.
        ibotty 9y ago
        If you control the OS, you also control the firmware (if you want a way to install new firmware from the OS). No way around.
      - jdiez17 9y ago
        Since the firmware updater is a Python program, you can audit the source code by looking at the relevant directory in site-packages before you accept. If you're really paranoid you can set up a periodic script that sends you an email if the contents of that directory change.
- alexktz 9y ago
  How deep does the rabbit hole of trust go...
  - jacquesm 9y ago
    All the way to the mask set.
- floatboth 9y ago
  How does this work anyway? Just a thing in the pre-installed OS that won't be there if a new OS is installed?
- cjbprime 9y ago
  This sounds pretty good. But just to finish exploring this: > But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place I think it's reasonable to feel differently about those two risks. Most notably, you only get one chance to load malware at the factory, whereas you have an infinite number of chances to push malware as a software update after that. It's harder for you to avoid being compromised forever than to avoid it at one specific moment. One person on your team could probably get malware signed and distributed as an targeted update without anyone else knowing, whereas doing it in the factory might take more coordination. It's also tidier from an attacker's perspective to deliver malware just-in-time to a specific user, rather than to everyone, or to a machine that you hope will end up in the hands of the target weeks/months later. It's less detectable. If you have a way to avoid being able to infer (e.g. by their IP address, correlated with other records) which human is asking for a firmware update file (or any update file) at the time it's downloaded, I recommend taking steps to deny yourself that knowledge.
j605 9y ago
It is delivered through the PPA that you enable after trusting system76. So I don't know where this reasoning is comes from. Also updates in Ubuntu are delivered only after the user explicitly invokes it(in GUI or using apt).
- e12e 9y ago
  Afaik the standard setup of Debian and Ubuntu is to install UnattendedUpgrades with automatic periodic installation of security updates. These aren't supposed to come with functional changes beyond patching security bugs, but there's no theoretical reason a security-patch couldn't bootstrap netbsd and change the entire os. It's code that runs as root. To be clear: I think this is a great default configuration, and it's been a long time coming - but it's just not true afaik that Debian/Ubuntu won't auto-update at all in the default configuration. [ed: Debian: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades "As of Debian 9 (Stretch) both the unattended-upgrades and apt-listchanges packages are installed by default and upgrades are enabled with the GNOME desktop."]

cassidyjames 9y ago

System76 employee here. I suppose the "automatic" could be re-worded; the data is automatically pushed to the machine but then the user always opts into the actual install. But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place. These updates are signed and verified with industry best practices. jackpot51 (the System76 engineer currently working on this) could probably detail it better than I can, though.

mulmen 9y ago
Is the user intervention required to install the firmware or do you still have the capability to install it without asking? Just because you ask for permission now does not mean that you have to. Why push the firmware before asking?
- cassidyjames 9y ago
  I asked David Jordan, the engineer working on the firmware updater. >Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code. The code is available at https://github.com/pop-os/system76-driver https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update https://github.com/system76/firmware-update
  - mulmen 9y ago
    Thanks for the reply! So you can push an update to the python code that allows you to push an update to the firmware without prompting? Sounds like we still rely on the security of your systems to prevent malicious firmware from being pushed.
    - yjftsjthsd-h 9y ago
      Well... yeah? They're the OS vendor; there is literally no way for them to do their job without having the ability to update the system.
      - mulmen 9y ago
        Yes they have to be able to update the system but in this case they are also able to update the firmware without asking which means anyone who can impersonate or coerce them can also update the firmware.
        ibotty 9y ago
        If you control the OS, you also control the firmware (if you want a way to install new firmware from the OS). No way around.
    - jdiez17 9y ago
      Since the firmware updater is a Python program, you can audit the source code by looking at the relevant directory in site-packages before you accept. If you're really paranoid you can set up a periodic script that sends you an email if the contents of that directory change.
alexktz 9y ago
How deep does the rabbit hole of trust go...
- jacquesm 9y ago
  All the way to the mask set.
floatboth 9y ago
How does this work anyway? Just a thing in the pre-installed OS that won't be there if a new OS is installed?
cjbprime 9y ago
This sounds pretty good. But just to finish exploring this: > But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place I think it's reasonable to feel differently about those two risks. Most notably, you only get one chance to load malware at the factory, whereas you have an infinite number of chances to push malware as a software update after that. It's harder for you to avoid being compromised forever than to avoid it at one specific moment. One person on your team could probably get malware signed and distributed as an targeted update without anyone else knowing, whereas doing it in the factory might take more coordination. It's also tidier from an attacker's perspective to deliver malware just-in-time to a specific user, rather than to everyone, or to a machine that you hope will end up in the hands of the target weeks/months later. It's less detectable. If you have a way to avoid being able to infer (e.g. by their IP address, correlated with other records) which human is asking for a firmware update file (or any update file) at the time it's downloaded, I recommend taking steps to deny yourself that knowledge.

j605 9y ago

It is delivered through the PPA that you enable after trusting system76. So I don't know where this reasoning is comes from. Also updates in Ubuntu are delivered only after the user explicitly invokes it(in GUI or using apt).

e12e 9y ago
Afaik the standard setup of Debian and Ubuntu is to install UnattendedUpgrades with automatic periodic installation of security updates. These aren't supposed to come with functional changes beyond patching security bugs, but there's no theoretical reason a security-patch couldn't bootstrap netbsd and change the entire os. It's code that runs as root. To be clear: I think this is a great default configuration, and it's been a long time coming - but it's just not true afaik that Debian/Ubuntu won't auto-update at all in the default configuration. [ed: Debian: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades "As of Debian 9 (Stretch) both the unattended-upgrades and apt-listchanges packages are installed by default and upgrades are enabled with the GNOME desktop."]