4 ms·

>secondly, worrying about firmware security issues is silly, because if you can't physically prevent access to the computer, it's pwned anyway no matter how sec

>secondly, worrying about firmware security issues is silly, because if you can't physically prevent access to the computer, it's pwned anyway no matter how secure the firmware is This is just completely wrong. You're peddling bad 20-year-old advice that hasn't ever been completely true, and especially not anymore. First, firmware updates often patch vulnerabilities that would allow attacks without physical access. Most obviously, vulnerabilities in the networking hardware can allow attackers to take control a machine by sending crafted packets. But other hardware issues can also, e.g., make it possible for untrusted code to perform a privilege escalation of some kind. You want firmware updates to protect yourself. Second, Macs/iOS devices and PCs—through the Secure Enclave and TPM, respectively—offer really good protection against physical access attacks. They verify the integrity of boot components and are only able to decrypt the system volume if they detect an untampered boot chain. Further, they can lock down direct memory access to protect powered-on systems from bypasses to user authentication. This is why nowadays, if a thief steals your laptop and you had the hard drive encryption with hardware security features on (on Windows, if you set up with a Microsoft Account, this is enabled without any further action by the user), you can feel fairly secure that even a technically savvy thief cannot access your data. Firmware updates can fix vulnerabilities in these security systems.

Maursault 5y ago
Nice straw man, because you didn't disagree with me, you disagreed with someone else's argument. Actually, in the old days, every update was applied as soon as humanly possible. It is only in the last 25 years that admins have been required to carefully examine updates and weigh the risks of production possibly going down or getting funked against I suppose apparently the incessant barrage of novel network firmware attacks.
- YPPH 5y ago
  It's not even arguably a straw man. Above, you said, "worrying about firmware security issues is silly, because if you can't physically prevent access to the computer". That's not someone else's claim, it's yours. If you didn't intend it to be your claim, you erred in expressing it, since that's what it conveys. That's the claim the other poster refuted. I simply don't understand you when you say they "disagreed with someone else's argument"? I control F'd the parent posts and found no such claim made by anyone, except you. Your (apparent) claim is obviously wrong for the reasons already pointed out by the other poster, including that there are firmware-level attacks that do not require physical access. Some of these vulnerabilities can be fixed by firmware updates. So, if possible, it makes sense to promptly apply each patch that will fix such a vulnerability.

Maursault 5y ago

Nice straw man, because you didn't disagree with me, you disagreed with someone else's argument. Actually, in the old days, every update was applied as soon as humanly possible. It is only in the last 25 years that admins have been required to carefully examine updates and weigh the risks of production possibly going down or getting funked against I suppose apparently the incessant barrage of novel network firmware attacks.

YPPH 5y ago
It's not even arguably a straw man. Above, you said, "worrying about firmware security issues is silly, because if you can't physically prevent access to the computer". That's not someone else's claim, it's yours. If you didn't intend it to be your claim, you erred in expressing it, since that's what it conveys. That's the claim the other poster refuted. I simply don't understand you when you say they "disagreed with someone else's argument"? I control F'd the parent posts and found no such claim made by anyone, except you. Your (apparent) claim is obviously wrong for the reasons already pointed out by the other poster, including that there are firmware-level attacks that do not require physical access. Some of these vulnerabilities can be fixed by firmware updates. So, if possible, it makes sense to promptly apply each patch that will fix such a vulnerability.