4 ms·

How about we just have a physical switch that you have to activate to update the firmware? I don't care about the rest of the software in the boot chain, an att

How about we just have a physical switch that you have to activate to update the firmware? I don't care about the rest of the software in the boot chain, an attacker can just trojan any binary that runs as root to get the same effect. As a user I don't care about the distinction between boot and the rest of the time.

TacticalCoder 3y ago
> How about we just have a physical switch that you have to activate to update the firmware? A very long time ago motherboards were like that. You couldn't flash the firmware without first physically moving a jumper on the motherboard (btw what you're asking for typically would be done with a jumper, not a switch, AFAIK). I remember a very heated argument with a friend of mine when I got my first mobo that didn't require a jumper to be physically modified to be able to flash the firmware. I told him it was heresy and that, invariably, exploits would come. Note that these first mobo that could see their firmware flashed without requiring changing the position of a jumper had literally not confirmation asked of anything. You'd just flash the firmware by running an exe.
jml7c5 3y ago
Chromebooks did this for a while; they had a write-protect screw on the motherboard that had to be removed to enter developer mode and/or flash custom firmware. Once you were done, you could reinsert the screw to lock it back down again.
- kogepathic 3y ago
  Chromebooks still do this, they just swapped the write-protect screw for disconnecting the battery [1] or using a special closed-case debug (CCD) USB-C cable (which was discontinued and is now neigh impossible to buy). You can DIY your own though [2] [1] https://wiki.mrchromebox.tech/Firmware_Write_Protect https://wiki.mrchromebox.tech/Firmware_Write_Protect [2] https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md https://chromium.googlesource.com/chromiumos/third_party/hdc...
- mr_toad 3y ago
  I have an Acer R11 that has one of those screws. It’s amusing, because back in the 80’s we used to have a saying: “Beware of programmers who carry screwdrivers.”

TacticalCoder 3y ago

> How about we just have a physical switch that you have to activate to update the firmware? A very long time ago motherboards were like that. You couldn't flash the firmware without first physically moving a jumper on the motherboard (btw what you're asking for typically would be done with a jumper, not a switch, AFAIK). I remember a very heated argument with a friend of mine when I got my first mobo that didn't require a jumper to be physically modified to be able to flash the firmware. I told him it was heresy and that, invariably, exploits would come. Note that these first mobo that could see their firmware flashed without requiring changing the position of a jumper had literally not confirmation asked of anything. You'd just flash the firmware by running an exe.

jml7c5 3y ago

Chromebooks did this for a while; they had a write-protect screw on the motherboard that had to be removed to enter developer mode and/or flash custom firmware. Once you were done, you could reinsert the screw to lock it back down again.

kogepathic 3y ago
Chromebooks still do this, they just swapped the write-protect screw for disconnecting the battery [1] or using a special closed-case debug (CCD) USB-C cable (which was discontinued and is now neigh impossible to buy). You can DIY your own though [2] [1] https://wiki.mrchromebox.tech/Firmware_Write_Protect https://wiki.mrchromebox.tech/Firmware_Write_Protect [2] https://chromium.googlesource.com/chromiumos/third_party/hdctools/+/HEAD/docs/ccd.md https://chromium.googlesource.com/chromiumos/third_party/hdc...
mr_toad 3y ago
I have an Acer R11 that has one of those screws. It’s amusing, because back in the 80’s we used to have a saying: “Beware of programmers who carry screwdrivers.”