9 ms·

UEFI is perhaps the single most egregious pile of garbage ever concieved by humans. I don't think it's possible to overstate how awful it truly is. Here's how

UEFI is perhaps the single most egregious pile of garbage ever concieved by humans. I don't think it's possible to overstate how awful it truly is. Here's how BIOS works: basically, the computer loads the first 512 bytes of disk into memory and jumps to it. The OS takes over from there and does whatever it needs to, like bootstrapping stage 2 and loading the kernel from the filesystem. The spec[0] is 46 pages long and you are granted the rights to reproduce, distribute, and implement it free of charge. Want to know how UEFI works? The spec[1] is a 2,899 page PDF which you have to pay to use in any way, including writing an implementation. [0] https://web.archive.org/web/20110715081320/http://www.phoenix.com/resources/specs-bbs101.pdf https://web.archive.org/web/20110715081320/http://www.phoeni... [1] https://uefi.org/specifications https://uefi.org/specifications Every copy of this specification should be found and burned. The ashes should be buried deep in a dark place and the earth above salted. Anyone who thinks this is the first rootkit made for it is completely insane. This thing was probably explicitly designed with rootkits in mind.

the8472 8y ago
Have you heard about the intel management engine?
- Sir_Cmpwn 8y ago
  At least the code is presumably sane. Minix is a good system.
janci 8y ago
> UEFI is perhaps the single most egregious pile of garbage ever concieved by humans Don't forget systemd.
userbinator 8y ago
which you have to pay to use in any way, including writing an implementation You may be misleading here, AFAIK the spec is free to implement (which helped spread its adoption) or else things like this would not exist or be sued out of existence: https://github.com/tianocore/tianocore.github.io/wiki/Coreboot_UEFI_payload https://github.com/tianocore/tianocore.github.io/wiki/Corebo... On the other hand, I agree with you and Linus on the actual spec itself: https://yarchive.net/comp/linux/efi.html https://yarchive.net/comp/linux/efi.html
- Sir_Cmpwn 8y ago
  >By downloading any of the UEFI Specifications, you acknowledge that no license, express or implied, is granted to you to distribute, additionally reproduce, implement or otherwise use for any purpose (other than to read only) the UEFI Specifications, and that all rights, title and interest in and to the UEFI Specifications, including all intellectual property rights of any type whatsoever, are owned by the UEFI Forum, or subject to rights granted to the UEFI Forum. Quote from the link above
  - userbinator 8y ago
    That is really a worthless statement compared to threats of legal action against the various open-source implementation out there, which would definitely raise attention --- if they actually happened, that is; I haven't found anything to suggest so. A search for "UEFI royalties" also does not yield anything. We get it, you hate UEFI as much as anyone else, but this is not really a valid issue to complain about.
    - cookiecaper 8y ago
      For the record, TianoCore is run by Intel. Intel was the author of the original EFI spec and afaik remains the driving force on the UEFI Forum. Wouldn't make much sense for them to sue themselves.
    - sandov 8y ago
      You're basically acknowledging that they can sue you for implementing it, but they won't do it because they don't feel like doing so, hence it doesn't matter that they can?
bubblethink 8y ago
The exploit in particular is SPI write bypass. That's the critical part, which is independent of UEFI. That is a separate Intel SMM vulnerability. If you can compromise the bios region, you can do whatever you want with the boot process, UEFI or not.
- HankB99 8y ago
  Thanks for clarifying. From the article: >Each time the system restarts, the code executes on boot, before the OS loads and before the system’s antivirus software is launched. That means that even if the device’s hard drive is replaced, the LoJack software will still operate. AFAIK on my systems the BIOS launches code in the EFI partition to boot the rest of the OS. an HDD/SSD wipe or replacement would defeat code installed in the EFI partition. Of course as you say, something added to the BIOS would run regardless. Apparently LoJack installs itself in the BIOS as well.
peter_d_sherman 8y ago
Agreed completely. But remember Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity" (https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor). UEFI smells like it was designed by a committee, so the value it adds (if any) seems far outweighed by the added complexity (and corresponding security challenges) it creates... to paraphrase Douglas Adams: (and replacing the word "Universe" with "BIOS":) “There is a theory which states that if ever anyone discovers exactly what the BIOS is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable... There is another theory which states that this has already happened...” <g>
- vladimirralev 8y ago
  People should stop quoting this "Never attribute to malice that which is adequately explained by stupidity". It's very outdated. Every malicious person is just playing dumb these days.
- duckMuppet 8y ago
  Don't forget the corollary to Hanlon's razor, Grey's law which i think is far more applicable here: 'Any sufficiently advanced incompetence is indistinguishable from malice'. I'm not sure why others who respond think if something is old it isn't applicable, I suppose I'm on the X/millennial border so I don't get it though.

the8472 8y ago

Have you heard about the intel management engine?

Sir_Cmpwn 8y ago
At least the code is presumably sane. Minix is a good system.

janci 8y ago

> UEFI is perhaps the single most egregious pile of garbage ever concieved by humans Don't forget systemd.

userbinator 8y ago

which you have to pay to use in any way, including writing an implementation You may be misleading here, AFAIK the spec is free to implement (which helped spread its adoption) or else things like this would not exist or be sued out of existence: https://github.com/tianocore/tianocore.github.io/wiki/Coreboot_UEFI_payload https://github.com/tianocore/tianocore.github.io/wiki/Corebo... On the other hand, I agree with you and Linus on the actual spec itself: https://yarchive.net/comp/linux/efi.html https://yarchive.net/comp/linux/efi.html

Sir_Cmpwn 8y ago
>By downloading any of the UEFI Specifications, you acknowledge that no license, express or implied, is granted to you to distribute, additionally reproduce, implement or otherwise use for any purpose (other than to read only) the UEFI Specifications, and that all rights, title and interest in and to the UEFI Specifications, including all intellectual property rights of any type whatsoever, are owned by the UEFI Forum, or subject to rights granted to the UEFI Forum. Quote from the link above
- userbinator 8y ago
  That is really a worthless statement compared to threats of legal action against the various open-source implementation out there, which would definitely raise attention --- if they actually happened, that is; I haven't found anything to suggest so. A search for "UEFI royalties" also does not yield anything. We get it, you hate UEFI as much as anyone else, but this is not really a valid issue to complain about.
  - cookiecaper 8y ago
    For the record, TianoCore is run by Intel. Intel was the author of the original EFI spec and afaik remains the driving force on the UEFI Forum. Wouldn't make much sense for them to sue themselves.
  - sandov 8y ago
    You're basically acknowledging that they can sue you for implementing it, but they won't do it because they don't feel like doing so, hence it doesn't matter that they can?

bubblethink 8y ago

The exploit in particular is SPI write bypass. That's the critical part, which is independent of UEFI. That is a separate Intel SMM vulnerability. If you can compromise the bios region, you can do whatever you want with the boot process, UEFI or not.

HankB99 8y ago
Thanks for clarifying. From the article: >Each time the system restarts, the code executes on boot, before the OS loads and before the system’s antivirus software is launched. That means that even if the device’s hard drive is replaced, the LoJack software will still operate. AFAIK on my systems the BIOS launches code in the EFI partition to boot the rest of the OS. an HDD/SSD wipe or replacement would defeat code installed in the EFI partition. Of course as you say, something added to the BIOS would run regardless. Apparently LoJack installs itself in the BIOS as well.

peter_d_sherman 8y ago

Agreed completely. But remember Hanlon's Razor: "Never attribute to malice that which is adequately explained by stupidity" (https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor). UEFI smells like it was designed by a committee, so the value it adds (if any) seems far outweighed by the added complexity (and corresponding security challenges) it creates... to paraphrase Douglas Adams: (and replacing the word "Universe" with "BIOS":) “There is a theory which states that if ever anyone discovers exactly what the BIOS is for and why it is here, it will instantly disappear and be replaced by something even more bizarre and inexplicable... There is another theory which states that this has already happened...” <g>

vladimirralev 8y ago
People should stop quoting this "Never attribute to malice that which is adequately explained by stupidity". It's very outdated. Every malicious person is just playing dumb these days.
duckMuppet 8y ago
Don't forget the corollary to Hanlon's razor, Grey's law which i think is far more applicable here: 'Any sufficiently advanced incompetence is indistinguishable from malice'. I'm not sure why others who respond think if something is old it isn't applicable, I suppose I'm on the X/millennial border so I don't get it though.