4 ms·

If the firmware source code was available, then nobody would have to care about "unofficial firmware".

Gigachad 4y ago
Isn’t it the exact opposite though? When it was all proprietary, and someone posted a bin file claiming it was official, you could somewhat reliably expect it was since no one else could have built it. Obviously you shouldn’t have trusted that, but with the code all available now, you should not at all trust any binaries which you can’t directly tie to MSI.
- roundandround 4y ago
  No it's been trivial to make cracked unsigned binaries via disassembly for a long time. Only a 1 bit change is often needed to disable something important. It's unclear that anyone making malicious binaries with their keys will bother to setup a proper compilation environment. With similar systems that intentionally support open source one can just switch to trusting some hobbyists keys instead of the compromised vendor. There's very little incentive for vendors to set that up correctly though.
- MereInterest 4y ago
  Not really, no. Anybody can take an existing bin file, open up a hex editor, and modify it. Append another function to the assembled binary (or overwrite a rarely used portion of the file), change the destination of a JMP instruction, and you’re now executing attacker-inserted code. Proprietary source code doesn’t provide any assurance of authenticity of the binary. For that, you need either cryptographic signatures (binary is vouchsafed by entity X), open source builds (binary behavior matches human-readable behavior in source), or ideally both (source is vouchsafed by entity X, binary behavior matches behavior of source).
  - sudosysgen 4y ago
    The firmwares are almost universally cryptographically signed on modern motherboards, and I'm guessing the warning comes from the signing keys being hacked.
sn_master 4y ago
I am assuming the problem is someone stole their certificate and can distribute the unofficial firmware as official one, bypassing security checks.

Isn’t it the exact opposite though? When it was all proprietary, and someone posted a bin file claiming it was official, you could somewhat reliably expect it was since no one else could have built it. Obviously you shouldn’t have trusted that, but with the code all available now, you should not at all trust any binaries which you can’t directly tie to MSI.

roundandround 4y ago
No it's been trivial to make cracked unsigned binaries via disassembly for a long time. Only a 1 bit change is often needed to disable something important. It's unclear that anyone making malicious binaries with their keys will bother to setup a proper compilation environment. With similar systems that intentionally support open source one can just switch to trusting some hobbyists keys instead of the compromised vendor. There's very little incentive for vendors to set that up correctly though.
MereInterest 4y ago
Not really, no. Anybody can take an existing bin file, open up a hex editor, and modify it. Append another function to the assembled binary (or overwrite a rarely used portion of the file), change the destination of a JMP instruction, and you’re now executing attacker-inserted code. Proprietary source code doesn’t provide any assurance of authenticity of the binary. For that, you need either cryptographic signatures (binary is vouchsafed by entity X), open source builds (binary behavior matches human-readable behavior in source), or ideally both (source is vouchsafed by entity X, binary behavior matches behavior of source).
- sudosysgen 4y ago
  The firmwares are almost universally cryptographically signed on modern motherboards, and I'm guessing the warning comes from the signing keys being hacked.

sn_master 4y ago

I am assuming the problem is someone stole their certificate and can distribute the unofficial firmware as official one, bypassing security checks.