4 ms·
Not really, no. Anybody can take an existing bin file, open up a hex editor, and modify it. Append another function to the assembled binary (or overwrite a ra
by MereInterest 4y ago
Not really, no. Anybody can take an existing bin file, open up a hex editor, and modify it. Append another function to the assembled binary (or overwrite a rarely used portion of the file), change the destination of a JMP instruction, and you’re now executing attacker-inserted code.
Proprietary source code doesn’t provide any assurance of authenticity of the binary. For that, you need either cryptographic signatures (binary is vouchsafed by entity X), open source builds (binary behavior matches human-readable behavior in source), or ideally both (source is vouchsafed by entity X, binary behavior matches behavior of source).
- sudosysgen 4y agoThe firmwares are almost universally cryptographically signed on modern motherboards, and I'm guessing the warning comes from the signing keys being hacked.