4 ms·

The real problem is lately we've been seeing malware that lives in UEFI from APT (Edit: Advanced Persistent Threat actor, usually state sponsored) groups. That

The real problem is lately we've been seeing malware that lives in UEFI from APT (Edit: Advanced Persistent Threat actor, usually state sponsored) groups. That means it is persistent and will typically disallow updating the UEFI once infected. And almost everyone hates OS updates, and the smallest percentage are willing to update firmware, because it can brick a device, so UEFI isn't going to get updated. This is one of the few things you MUST trust, even if you want to follow zero trust.

legalcorrection 4y ago
>the smallest percentage are willing to update firmware Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.
- metadat 4y ago
  Sometimes firmware updates make the system worse or even completely bricked. If the machine already working and stable, I've learned it's a risky / bad idea to eagerly apply firmware updates.
  - bayindirh 4y ago
    Flash media is cheap nowadays, and HP EliteBook series laptops store a couple of previous BIOS versions on board to make rollback possible. Also these higher end laptops can try previous version of their firmware if they fail to boot with the latest one. Failing to see how Lenovo can't implement something like that.
    - TheBrokenRail 4y ago
      I know my ThinkPad gives me a "self-healing BIOS" message whenever I update the firmware (on a side note, fwupd is amazing), which according to Lenovo's Twitter is a BIOS backup (https://twitter.com/lenovo/status/1297785406239514624?lang=en https://twitter.com/lenovo/status/1297785406239514624?lang=e...).
  - legalcorrection 4y ago
    Bad idea because firmware bugs are a growing attack vector and you are leaving yourself exposed to known, easily-exploited vulnerabilities by not staying up to date.
- phkahler 4y ago
  Firmware should have a physical switch to enable updating it. Fuck self checked signatures. There, fixed all the BIOS and firmware exploits for you. You're welcome.
  - legalcorrection 4y ago
    That only works for IT-managed devices (and even then, is very expensive in terms of labor). Consumer devices need auto-update to protect them from known vulnerabilities. Auto-update is hard to get right, but your product is defective by design if it doesn't support it.
    - phkahler 4y ago
      You can auto-update AND tell the user to flip the switch as part of the update process.
  - downrightmike 4y ago
    It is possible https://hackernoon.com/how-the-nintendo-switch-prevents-downgrades-by-irreparably-blowing-its-own-fuses-884bd3b7a8ba https://hackernoon.com/how-the-nintendo-switch-prevents-down...
  - mjg59 4y ago
    Firmware vulnerabilities aren't necessarily used to target the firmware or to try to gain persistence - vulnerabilities in SMM handlers, for instance, can be used for privilege escalation at runtime.
    - R0b0t1 4y ago
      That is true, but disabling firmware update (should) limit the available persistence for the malware.
      - mjg59 4y ago
        Limit, but it doesn't remove all avenues of attack. Firmware config needs to be writable at runtime (things like cold boot attack protection require state to persist over power cycles, even if you don't think other firmware config should be modifiable without physical presence), and the code that parses that could still contain vulnerabilities. Making firmware mostly read-only would mitigate certain classes of attack, but not all of them.
omegalulw 4y ago
I mean sure, but no one is forcing users to install software from APT groups. That's a choice people make. The general point is that you should be able to use hardware for general computing. There can be a switch that by default limits to software signed by your original manufacturer but that should toggleable by the end user.
- _jal 4y ago
  > but no one is forcing users to install software from APT groups. That's a choice people make. ... what?
  - vlovich123 4y ago
    OP probably misunderstood it as Advanced Pacakge Tool, the system Debian uses for package management (ie APT sources) instead of Advanced Persistent Threat which is what the quote is talking about (ie sophisticated hackers, usually state backed/state owned that attack your machine).
    - babypuncher 4y ago
      They said "APT groups" which makes me think they were not talking about the package manager.
      - downrightmike 4y ago
        Scary world out there: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat
- bayindirh 4y ago
  > I mean sure, but no one is forcing users to install software from APT groups. Yeah, the members of said groups handle that part, so the software installs automatically. No forcing and consent is necessary in most scenarios. :)

legalcorrection 4y ago

>the smallest percentage are willing to update firmware Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.

metadat 4y ago
Sometimes firmware updates make the system worse or even completely bricked. If the machine already working and stable, I've learned it's a risky / bad idea to eagerly apply firmware updates.
- bayindirh 4y ago
  Flash media is cheap nowadays, and HP EliteBook series laptops store a couple of previous BIOS versions on board to make rollback possible. Also these higher end laptops can try previous version of their firmware if they fail to boot with the latest one. Failing to see how Lenovo can't implement something like that.
  - TheBrokenRail 4y ago
    I know my ThinkPad gives me a "self-healing BIOS" message whenever I update the firmware (on a side note, fwupd is amazing), which according to Lenovo's Twitter is a BIOS backup (https://twitter.com/lenovo/status/1297785406239514624?lang=en https://twitter.com/lenovo/status/1297785406239514624?lang=e...).
- legalcorrection 4y ago
  Bad idea because firmware bugs are a growing attack vector and you are leaving yourself exposed to known, easily-exploited vulnerabilities by not staying up to date.
phkahler 4y ago
Firmware should have a physical switch to enable updating it. Fuck self checked signatures. There, fixed all the BIOS and firmware exploits for you. You're welcome.
- legalcorrection 4y ago
  That only works for IT-managed devices (and even then, is very expensive in terms of labor). Consumer devices need auto-update to protect them from known vulnerabilities. Auto-update is hard to get right, but your product is defective by design if it doesn't support it.
  - phkahler 4y ago
    You can auto-update AND tell the user to flip the switch as part of the update process.
- downrightmike 4y ago
  It is possible https://hackernoon.com/how-the-nintendo-switch-prevents-downgrades-by-irreparably-blowing-its-own-fuses-884bd3b7a8ba https://hackernoon.com/how-the-nintendo-switch-prevents-down...
- mjg59 4y ago
  Firmware vulnerabilities aren't necessarily used to target the firmware or to try to gain persistence - vulnerabilities in SMM handlers, for instance, can be used for privilege escalation at runtime.
  - R0b0t1 4y ago
    That is true, but disabling firmware update (should) limit the available persistence for the malware.
    - mjg59 4y ago
      Limit, but it doesn't remove all avenues of attack. Firmware config needs to be writable at runtime (things like cold boot attack protection require state to persist over power cycles, even if you don't think other firmware config should be modifiable without physical presence), and the code that parses that could still contain vulnerabilities. Making firmware mostly read-only would mitigate certain classes of attack, but not all of them.

omegalulw 4y ago

I mean sure, but no one is forcing users to install software from APT groups. That's a choice people make. The general point is that you should be able to use hardware for general computing. There can be a switch that by default limits to software signed by your original manufacturer but that should toggleable by the end user.

_jal 4y ago
> but no one is forcing users to install software from APT groups. That's a choice people make. ... what?
- vlovich123 4y ago
  OP probably misunderstood it as Advanced Pacakge Tool, the system Debian uses for package management (ie APT sources) instead of Advanced Persistent Threat which is what the quote is talking about (ie sophisticated hackers, usually state backed/state owned that attack your machine).
  - babypuncher 4y ago
    They said "APT groups" which makes me think they were not talking about the package manager.
    - downrightmike 4y ago
      Scary world out there: https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat
bayindirh 4y ago
> I mean sure, but no one is forcing users to install software from APT groups. Yeah, the members of said groups handle that part, so the software installs automatically. No forcing and consent is necessary in most scenarios. :)