4 ms·

Physical switches can easily be bypassed in the code.

by sjtrny 12y ago

mmastrac 12y ago
Not if the physical switch is directly controlling the NAND's !WP pin. If that's possible it's beyond my knowledge. eg: http://www.hynix.com/datasheet/pdf/flash/HY27UF084G2M%20Series%28Rev.0.7%29.pdf http://www.hynix.com/datasheet/pdf/flash/HY27UF084G2M%20Seri...
- sjtrny 12y ago
  It seems unlikely that any PC manufacturer (Apple, Dell, HP etc) would force their users to open up their machines and flick the WP switch on the hard drive controller to install a firmware update.
  - andrewpi 12y ago
    They could wire it to a key on the keyboard, so you have to hold down 'Esc' to flash a firmware update, for example.
    - mmastrac 12y ago
      Unless you've got a direct electrical connection between the Esc key and that pin, you've unfortunately introduced a way for software to do the same thing as holding Esc.
  - mmastrac 12y ago
    How often have you honestly installed a firmware update on an HDD ever? I think I've done it maybe twice in my lifetime. Both times required jumping through crazy hoops creating boot floppies. Apple would likely just ask you to bring it into the Apple store.
    - eli 12y ago
      Apple pushes out HDD firmware updates more often than you think.
      - turval 12y ago
        Can you link to some examples?
        xenophonf 12y ago
        I can: http://support.apple.com/en-us/HT201966 http://support.apple.com/en-us/HT201966 http://support.apple.com/kb/DL1378 http://support.apple.com/kb/DL1378 Here's one from Lenovo: http://support.lenovo.com/us/en/downloads/migr-62282 http://support.lenovo.com/us/en/downloads/migr-62282 With suitable search terms you'll find similar updates from other OEMs.
  - userbinator 12y ago
    Motherboards used to have physical write-protection jumpers for the BIOS flash, and that was something no malware could ever bypass. This was also in the days when BIOS updates were quite rare, so opening up the case to do it seems a very reasonable action to take. I have only updated the BIOS twice on two machines, in over a decade; "don't fix it if it ain't broke" is how I tend to approach updates in general. For HDD firmware, I think it's something that should not be updatable at all through regular software; instead it's something manufacturers should be getting right before shipping product. I've owned disks from over two decades ago, and not once have I needed to update any firmware on them. Somehow I feel that this "update culture" has just lead to more problems due to propagating an attitude of "it can always be updated later", where shipping devices with imperfect firmware becomes almost acceptable and it can sometimes become a case of fixing one bug and introducing others.
    - tunap 12y ago
      "update culture" Don't forget feature bloat & the increased attack surface they inevitably create.
    - Pxtl 12y ago
      Yup. I loathe th update culture - every wifi router I've bought in the past decade has been barely useable before updating its firmware to current. Regular WiFi crashes requiring re-setting the router should not be the default state.
  - AnthonyMouse 12y ago
    > It seems unlikely that any PC manufacturer (Apple, Dell, HP etc) would force their users to open up their machines and flick the WP switch on the hard drive controller to install a firmware update. http://support.apple.com/kb/DL1283 http://support.apple.com/kb/DL1283 "Locate the programmer's button on the side of the iMac, to the right of the reset button. Press and hold in the programmer's button. You may need to use a pen or a straightened paper clip."
    - sjtrny 12y ago
      > iMac G3 Which they stopped making around 2003. Further the button was accessible from the outside.
bdonlan 12y ago
Not if the physical switch physically disconnects the write enable pin on the flash chip.
- kabdib 12y ago
  WP pins are not necessarily meaningful. All of the on-chip flash for embedded micros that I've seen in the last few years have not needed an external WP pin. Presumably stock external flash parts are okay, but it's still conceivable that evil circuitry could cause a write, or at least an addressing "mistake".
  - marssaxman 12y ago
    Are you talking about flash embedded in the mcu, or separate flash chips? The mcu can usually reflash itself, modulo fuses, but I can't recall having seen a standalone flash chip which lacked a write protect (or write-enable) pin. A physical toggle switch on that line seems like a solid protection against NSA style firmware hacking.
    - kabdib 12y ago
      Unless you're talking about a pin supplying a required programming voltage, that WE pin is just hooked up to internal gates that suppress writes. There are relatively easy ways to back-door gates (e.g., with secret access patterns or data sequences). Yeah, I'm a suspicious cuss.

Physical switches can easily be bypassed in the code.

by sjtrny 12y ago

Physical switches can easily be bypassed in the code.

Not if the physical switch is directly controlling the NAND's !WP pin. If that's possible it's beyond my knowledge. eg: http://www.hynix.com/datasheet/pdf/flash/HY27UF084G2M%20Series%28Rev.0.7%29.pdf http://www.hynix.com/datasheet/pdf/flash/HY27UF084G2M%20Seri...

sjtrny 12y ago
It seems unlikely that any PC manufacturer (Apple, Dell, HP etc) would force their users to open up their machines and flick the WP switch on the hard drive controller to install a firmware update.
- andrewpi 12y ago
  They could wire it to a key on the keyboard, so you have to hold down 'Esc' to flash a firmware update, for example.
  - mmastrac 12y ago
    Unless you've got a direct electrical connection between the Esc key and that pin, you've unfortunately introduced a way for software to do the same thing as holding Esc.
- mmastrac 12y ago
  How often have you honestly installed a firmware update on an HDD ever? I think I've done it maybe twice in my lifetime. Both times required jumping through crazy hoops creating boot floppies. Apple would likely just ask you to bring it into the Apple store.
  - eli 12y ago
    Apple pushes out HDD firmware updates more often than you think.
    - turval 12y ago
      Can you link to some examples?
      - xenophonf 12y ago
        I can: http://support.apple.com/en-us/HT201966 http://support.apple.com/en-us/HT201966 http://support.apple.com/kb/DL1378 http://support.apple.com/kb/DL1378 Here's one from Lenovo: http://support.lenovo.com/us/en/downloads/migr-62282 http://support.lenovo.com/us/en/downloads/migr-62282 With suitable search terms you'll find similar updates from other OEMs.
- userbinator 12y ago
  Motherboards used to have physical write-protection jumpers for the BIOS flash, and that was something no malware could ever bypass. This was also in the days when BIOS updates were quite rare, so opening up the case to do it seems a very reasonable action to take. I have only updated the BIOS twice on two machines, in over a decade; "don't fix it if it ain't broke" is how I tend to approach updates in general. For HDD firmware, I think it's something that should not be updatable at all through regular software; instead it's something manufacturers should be getting right before shipping product. I've owned disks from over two decades ago, and not once have I needed to update any firmware on them. Somehow I feel that this "update culture" has just lead to more problems due to propagating an attitude of "it can always be updated later", where shipping devices with imperfect firmware becomes almost acceptable and it can sometimes become a case of fixing one bug and introducing others.
  - tunap 12y ago
    "update culture" Don't forget feature bloat & the increased attack surface they inevitably create.
  - Pxtl 12y ago
    Yup. I loathe th update culture - every wifi router I've bought in the past decade has been barely useable before updating its firmware to current. Regular WiFi crashes requiring re-setting the router should not be the default state.
- AnthonyMouse 12y ago
  > It seems unlikely that any PC manufacturer (Apple, Dell, HP etc) would force their users to open up their machines and flick the WP switch on the hard drive controller to install a firmware update. http://support.apple.com/kb/DL1283 http://support.apple.com/kb/DL1283 "Locate the programmer's button on the side of the iMac, to the right of the reset button. Press and hold in the programmer's button. You may need to use a pen or a straightened paper clip."
  - sjtrny 12y ago
    > iMac G3 Which they stopped making around 2003. Further the button was accessible from the outside.

bdonlan 12y ago

Not if the physical switch physically disconnects the write enable pin on the flash chip.

kabdib 12y ago
WP pins are not necessarily meaningful. All of the on-chip flash for embedded micros that I've seen in the last few years have not needed an external WP pin. Presumably stock external flash parts are okay, but it's still conceivable that evil circuitry could cause a write, or at least an addressing "mistake".
- marssaxman 12y ago
  Are you talking about flash embedded in the mcu, or separate flash chips? The mcu can usually reflash itself, modulo fuses, but I can't recall having seen a standalone flash chip which lacked a write protect (or write-enable) pin. A physical toggle switch on that line seems like a solid protection against NSA style firmware hacking.
  - kabdib 12y ago
    Unless you're talking about a pin supplying a required programming voltage, that WE pin is just hooked up to internal gates that suppress writes. There are relatively easy ways to back-door gates (e.g., with secret access patterns or data sequences). Yeah, I'm a suspicious cuss.