5 ms·
I am yet to see _any_ consumer-oriented motherboard where SMBIOS descriptions have even a passing relationship to the actual hardware. I would not be surprised
by AshamedCaptain 1y ago
I am yet to see _any_ consumer-oriented motherboard where SMBIOS descriptions have even a passing relationship to the actual hardware. I would not be surprised if this malware would also fail in 50% of real hardware out there. But I also guess malware can afford this failure rate; as long as it guarantees it also fails on 100% of VMs/debuggers, it is worth it.
But if these assumptions are true then I'd presume malware authors would do timing checks rather than the trivially "emulable" SMBIOS.
- msgodel 1y agoHow does Linux find the fans these days? Is it an ACPI/EFI thing now? Nearly all my machines seem to have correct fans/sensors.
- surajrmal 1y agoYes acpi is far more reliable.
- AshamedCaptain 1y agoThrough a bazillion of practically motherboard-model-specific hacks: https://lxr.linux.no/#linux+v6.7.1/drivers/hwmon/ https://lxr.linux.no/#linux+v6.7.1/drivers/hwmon/
- baby_souffle 1y ago> I am yet to see _any_ consumer-oriented motherboard where SMBIOS descriptions have even a passing relationship to the actual hardware. This seems to be especially true for cheap chineese boxes. If I had a dollar for every time I saw "to be filled in by OEM" strings in "live/production" BIOS images ... i'd be retired :).
- smileybarry 1y agoI’m fairly sure my expensive ASUS ROG motherboard (ergo: not even their budget line) also had a “to be filled in by OEM” string that I couldn’t even override. (ASUS have a utility but it’s not publicly available, probably just for computer shops)
- gruez 1y agoThat's basically my experience for 2 other "gaming" motherboard brands that aren't ASUS as well. My guess is that people who build their own PCs probably don't care about SMBIOS serial numbers being properly populated, so why bother?
- smileybarry 1y agoI would care if I could change it, but you need a proprietary tool that you can't obtain. (Every other way I found involved patching the UEFI and turning off Secure Boot)
- iforgotpassword 1y agoBut that's exactly the point. Computer shops that sell complete systems are supposed to put their name in the "system manufacturer" field. If you bought the mainboard yourself and built your own system, then who do you think should have replaced that string?
- smileybarry 1y agoI get that, but I'd expect it to be a setting I can change in BIOS, or at least default to the motherboard's model number. Instead, if I build my own, I just can't change it ever because ASUS refuse to release it publicly. Hell, even the shop I used for the previous PC didn't have such a tool. (And if you change it in Windows, it's rewritten from SMBIOS every boot)
- theshackleford 1y agoI worked in PC stores for a long time and never had any such access to such a tool. Sounds like something only the big OEM's would get honestly.
- smileybarry 1y agoIt's mentioned in some ASUS docs, but it's not available on their support anywhere. Probably reserved for big OEMs, yeah.
- kotaKat 1y agoBonus points for a non-unique UEFI UUID that is already enrolled in some random company's Microsoft Intune / Windows Autopilot instance so when you fire it up off a fresh Windows install it begs you to sign into $RANDOM_COMPANY_WITH_BAD_IT_CONTROLS. Triple-points if the vendor includes a sticker telling you to complete Windows OOBE without connecting it to the Internet to avoid this.
- snickerdoodle12 1y agoI still can't believe that microsoft allows companies to essentially brick machines they don't even own like that. Seems criminal to me.
- dylan604 1y agoMore criminal than hard coding UUID for some other device?
- snickerdoodle12 1y agoYou can do whatever you want with your device. Microsoft is also doing whatever they want with your device.
- sweetjuly 1y agoIf the OEM hadn't messed up and reused UUIDs, it would be "Microsoft letting companies do whatever they want with their device", which is not unreasonable. OEMs reusing UUIDs for some ridiculous reason is breaking down the chain of "whose device is it".
- shakna 1y agoMistakes happen. It is inevitable at scale. So maybe we need softer recovery processes?
- AnthonyMouse 1y ago
- iforgotpassword 1y agoBut this is correct, if the Mainboard was bought as is and was not part of a complete system, the system manufacturer is obviously not filled out as there is none.
- encom 1y ago# Manufacturer: Micro-Star International Co., Ltd. # Product Name: PRO Z790-A WIFI (MS-7E07) $ sudo cat /sys/firmware/dmi/tables/DMI | strings | grep -i filled | wc -l 10 Sigh...
- frollogaston 1y agoIs it the actual malware checking this or some researcher-created malware samples?
- hinkley 1y agoMalware has bugs. In fact some viruses have done far more damage than the author intended due to bugs. There was a substantially effective virus years ago that made it around the world in 90 minutes, and it turns out a bug in its networking code caused it to spread half as fast as it should have. Meaning it should have been everywhere in 45 minutes. You can still do a lot of damage without hitting every machine in existence.