4 ms·

> You absolutely do not need to be able to control a machine remotely to deploy automatic updates. Huh? How are you supposed to deploy the update then, or make

> You absolutely do not need to be able to control a machine remotely to deploy automatic updates. Huh? How are you supposed to deploy the update then, or make it effective? I think the definition of "remotely control" differs somewhat from mine. I could agree that you don't need to uniquely address a remote machine to deploy updates, but having control over the machine (if only for a moment) is the purpose of the update process.

shakna 6y ago
"control remotely" as in "issue arbitrary commands" is absolutely _not_ required for an update mechanism. The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. You don't need complete control over a machine for an update mechanism. But the entire update infrastructure has issues... Firmware binaries downloaded over unprotected basic FTP... No checksums... No authenticated signatures... And arbitrary commands issued at the root level.
- rhn_mk1 6y ago
  > The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. The problem with this statement is that the machine doesn't know what sequence of actions is necessary to put the system into the "updated" state. If it knew, it wouldn't have to contact anything in order to update itself. It would already have known.
  - blumomo 6y ago
    Where in „client pulls a signed image with a secure and trusted process from the update server, flashes it, then swaps it with its previous image“ does the update server command any control over the client?
    - rhn_mk1 6y ago
      That depends on the contents of the supplied image. But I agree, it's more about the need for the ability to take over control rather than exercising the ability.
  - shakna 6y ago
    > If it knew, it wouldn't have to contact anything in order to update itself. It would already have known. Eh? That's how most package managers work. They only issue a very small number of commands to put them into an "updated" state. They don't generally do arbitrary things. For example, if we take a look into aptitude, the deb packages it eventually fetches after running various authentications, contains: + A directory listing. (Contents-<arch>.gz) + Paths and checksums. (Release) + Signing information. It doesn't have an arbitrary listing of commands to put it into the "updated" set - that's already decided by the format. The machine _does_ know the sequence of actions that is necessary. You don't need some kind of Turing complete monstrosity that can do absolutely anything to update it. In the case of a _firmware update_ that's even simpler! Most of the time you're either replacing a kernel, or flashing the firmware to a pre-decided memory address. Both of those actions are decided long before you even begin issuing updates.
- anfilt 6y ago
  If you deploy a firmware update it contains new instructions that can do anything. The problem is the hardcoded credentials that an other 3rd party could dump from a device and then could be used to attack other devices. What they should have done if they wanted automatic updates was just have a public key on devices. They could then sign any updates with their private key. Still with automatic updates you have to trust the vendor. However, with what they did updates/commands could be coming from anyone willing to dump device firmware.
nitrogen 6y ago
Machines can pull rather than manufacturers push, using cryptographic signatures to verify origin. At no point during, say, a Linux embedded device doing an "apt-get upgrade" in a cron job, is anyone remotely controlling the machine.
- rhn_mk1 6y ago
  I see, the difference is that I still consider it remote control even when the act of programming is separated by time from the act of execution.
  - eeZah7Ux 6y ago
    ...the all software in the world is a form of "remote control" on the initial installation.
    - rhn_mk1 6y ago
      I don't disagree with that :)
faeyanpiraat 6y ago
Let me summarize the issue: "I was surprised to find a user account 'zyfwp' with a password hash" "this account seemed to work on both the SSH and web interface" "Globally, more than 100.000 devices have exposed their web interface to the internet" Linux manages to auto update itself by fetching updates from the outside, when IT wants to do so. Zyxel tried to add a function where THEY can access devices over the internet and do who-knows-what whenever they wanted. And they did such a poor job of that, that they managed to give access to the devices to everybody.

shakna 6y ago

"control remotely" as in "issue arbitrary commands" is absolutely _not_ required for an update mechanism. The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. You don't need complete control over a machine for an update mechanism. But the entire update infrastructure has issues... Firmware binaries downloaded over unprotected basic FTP... No checksums... No authenticated signatures... And arbitrary commands issued at the root level.

rhn_mk1 6y ago
> The machine _itself_ can check for updates, and issue _only_ those commands that are _necessary_. The problem with this statement is that the machine doesn't know what sequence of actions is necessary to put the system into the "updated" state. If it knew, it wouldn't have to contact anything in order to update itself. It would already have known.
- blumomo 6y ago
  Where in „client pulls a signed image with a secure and trusted process from the update server, flashes it, then swaps it with its previous image“ does the update server command any control over the client?
  - rhn_mk1 6y ago
    That depends on the contents of the supplied image. But I agree, it's more about the need for the ability to take over control rather than exercising the ability.
- shakna 6y ago
  > If it knew, it wouldn't have to contact anything in order to update itself. It would already have known. Eh? That's how most package managers work. They only issue a very small number of commands to put them into an "updated" state. They don't generally do arbitrary things. For example, if we take a look into aptitude, the deb packages it eventually fetches after running various authentications, contains: + A directory listing. (Contents-<arch>.gz) + Paths and checksums. (Release) + Signing information. It doesn't have an arbitrary listing of commands to put it into the "updated" set - that's already decided by the format. The machine _does_ know the sequence of actions that is necessary. You don't need some kind of Turing complete monstrosity that can do absolutely anything to update it. In the case of a _firmware update_ that's even simpler! Most of the time you're either replacing a kernel, or flashing the firmware to a pre-decided memory address. Both of those actions are decided long before you even begin issuing updates.
anfilt 6y ago
If you deploy a firmware update it contains new instructions that can do anything. The problem is the hardcoded credentials that an other 3rd party could dump from a device and then could be used to attack other devices. What they should have done if they wanted automatic updates was just have a public key on devices. They could then sign any updates with their private key. Still with automatic updates you have to trust the vendor. However, with what they did updates/commands could be coming from anyone willing to dump device firmware.

nitrogen 6y ago

Machines can pull rather than manufacturers push, using cryptographic signatures to verify origin. At no point during, say, a Linux embedded device doing an "apt-get upgrade" in a cron job, is anyone remotely controlling the machine.

rhn_mk1 6y ago
I see, the difference is that I still consider it remote control even when the act of programming is separated by time from the act of execution.
- eeZah7Ux 6y ago
  ...the all software in the world is a form of "remote control" on the initial installation.
  - rhn_mk1 6y ago
    I don't disagree with that :)

faeyanpiraat 6y ago

Let me summarize the issue: "I was surprised to find a user account 'zyfwp' with a password hash" "this account seemed to work on both the SSH and web interface" "Globally, more than 100.000 devices have exposed their web interface to the internet" Linux manages to auto update itself by fetching updates from the outside, when IT wants to do so. Zyxel tried to add a function where THEY can access devices over the internet and do who-knows-what whenever they wanted. And they did such a poor job of that, that they managed to give access to the devices to everybody.