5 ms·

Damn Vulnerable UEFI

98 points by cloudripper 2y ago

getcrunk 2y ago
Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers
- userbinator 2y ago
  Be careful what you wish for, as the overwhelming purpose of discovered exploits will be to give freedom to the rightful owners of devices.
- yjftsjthsd-h 2y ago
  > Or break up the damn covert cabal that’s the 3 major bios producers I'm curious about that - why isn't there more competition, especially when everything you need to do it without them is easily available online? Like, not just specs, all the actual code you'd need is open source and AIUI friendly to use. Frankly, why aren't most motherboards shipping with lightly-patched coreboot+edk2?
  - Rinzler89 2y ago
    >I'm curious about that - why isn't there more competition Because like most consumer PC parts, it's a race to the bottom low margin low wage business, usually offshored to Asia, that's only remotely profitable for the top 2-3 players who captured the market and optimized the costs, processes, development and supply chain to the max. Why would anyone else want to enter such a market to compete for even lower profits?
    - LtdJorge 2y ago
      Most, if not all, consumer motherboard manufacturers are Asian themselves (Taiwan)
      - Rinzler89 2y ago
        Sure, but must major BIOS manufacturers, Award, Phoenix, AMI are American AFAIK.
        FuriouslyAdrift 2y ago
        Don't forget the co-inventor of EFI (along with Intel), Insyde...
        LtdJorge 2y ago
        AMI sure is, says it right in the name, lol
- prmoustache 2y ago
  At the very least I find it comforting that whenever I need to enter the bios on one of my thinkpad I get a snappy keyboard driven interface that barely changed in 30 years. I'll take that anyday over that slow as hell mouse driven firmware horror Dell and HP have been producing for their servers and laptops.
  - p_l 2y ago
    The nice thing about UEFI is that the build-in "UI framework" means you can get UI from oproms this way as well. It also means you can bypass the mouse driven monstrosities from at least Dell by booting with console on serial port (for example through IPMI) - and all the same options are available, in vt-100 compatible form. What relief after finding a server where the base bios was fine, but the intel raid card had its own SVGA+PS/2 mouse requiring setup interface... The mad scramble for a mouse to add to crash cart...
iam-TJ 2y ago
I had a chuckle when I saw "Challenge 1: Singing Binaries" [0] [0] https://github.com/hacking-support/DVUEFI/tree/main/docs/2-secureboot https://github.com/hacking-support/DVUEFI/tree/main/docs/2-s...
paol 2y ago
I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.
- harshreality 2y ago
  How do you build a BIOS successor that's not complicated, when it has to be able to reflash bios from a file on a fat32 partition on a usb stick, because all the other historical ways of reflashing bios were difficult and more fragile? How do you build a BIOS successor that's not complicated when it needs to allow an OS to alter boot settings for the next boot? Granted, most of what goes on in a BIOS is displaying and changing variables involved in getting the system running, and maintaining those values, which just requires some sort of minimal editing interface and nv storage, but then... users appear. They want to be able to use a mouse. They want an ability to configure their raid chipset prior to boot, or netboot, and HW makers want to implement that in a way that's not some arcane raw assembly dance between BIOS and additional chip FW. What then? I don't think the complaint is about complexity, but about code quality and architecture. This isn't the only case where an old, simpler but less capable and annoying, system has been replaced by a much more complex system that is much hated and [initially] buggy and less secure, but also more or less gets the job done better than the old way, and where average users of the new system find it easier and more productive. If there wasn't a case where a hardware manufacturer needed a capability prior to the OS taking over, or to modify their HW settings from the OS in a portable way, it wouldn't be in UEFI, right? Calling UEFI a full operating system seems needlessly inflammatory. It's not a linux or windows kernel. It has to do a fair amount of the basics, but so does any kernel running on a general purpose chip and interfacing with a bunch of other people's code. UEFI is terrible. Baseband firmwares are terrible. Security processor firmwares are terrible. AMT is terrible. Okay, but we still need them.
  - blueflow 2y ago
    No, we don't need them. Look at the OpenWRT ecosystem and the routers it runs on. Those cheap plastic routers come with pretty dumb bootloaders and it works. Its just the x86 platform that is shite.

98 points by cloudripper 2y ago

Hopefully this will spur more research and visibility and unfortunately active exploits, but that would finally put pressure on oems to secure their firmwares. Or break up the damn covert cabal that’s the 3 major bios producers

userbinator 2y ago
Be careful what you wish for, as the overwhelming purpose of discovered exploits will be to give freedom to the rightful owners of devices.
yjftsjthsd-h 2y ago
> Or break up the damn covert cabal that’s the 3 major bios producers I'm curious about that - why isn't there more competition, especially when everything you need to do it without them is easily available online? Like, not just specs, all the actual code you'd need is open source and AIUI friendly to use. Frankly, why aren't most motherboards shipping with lightly-patched coreboot+edk2?
- Rinzler89 2y ago
  >I'm curious about that - why isn't there more competition Because like most consumer PC parts, it's a race to the bottom low margin low wage business, usually offshored to Asia, that's only remotely profitable for the top 2-3 players who captured the market and optimized the costs, processes, development and supply chain to the max. Why would anyone else want to enter such a market to compete for even lower profits?
  - LtdJorge 2y ago
    Most, if not all, consumer motherboard manufacturers are Asian themselves (Taiwan)
    - Rinzler89 2y ago
      Sure, but must major BIOS manufacturers, Award, Phoenix, AMI are American AFAIK.
      - FuriouslyAdrift 2y ago
        Don't forget the co-inventor of EFI (along with Intel), Insyde...
      - LtdJorge 2y ago
        AMI sure is, says it right in the name, lol
prmoustache 2y ago
At the very least I find it comforting that whenever I need to enter the bios on one of my thinkpad I get a snappy keyboard driven interface that barely changed in 30 years. I'll take that anyday over that slow as hell mouse driven firmware horror Dell and HP have been producing for their servers and laptops.
- p_l 2y ago
  The nice thing about UEFI is that the build-in "UI framework" means you can get UI from oproms this way as well. It also means you can bypass the mouse driven monstrosities from at least Dell by booting with console on serial port (for example through IPMI) - and all the same options are available, in vt-100 compatible form. What relief after finding a server where the base bios was fine, but the intel raid card had its own SVGA+PS/2 mouse requiring setup interface... The mad scramble for a mouse to add to crash cart...

iam-TJ 2y ago

I had a chuckle when I saw "Challenge 1: Singing Binaries" [0] [0] https://github.com/hacking-support/DVUEFI/tree/main/docs/2-secureboot https://github.com/hacking-support/DVUEFI/tree/main/docs/2-s...

paol 2y ago

I think I've ranted about this in HN before, but UEFI is so pointlessly complex. Modern OSes don't rely on the BIOS for basically anything. When choosing the successor to the old PC BIOS we could have made something extremely minimal. Instead UEFI goes hard in the opposite direction. It's basically a full blown operating system with all the attendant complexity and, unsurprisingly, vulnerability surface.

harshreality 2y ago
How do you build a BIOS successor that's not complicated, when it has to be able to reflash bios from a file on a fat32 partition on a usb stick, because all the other historical ways of reflashing bios were difficult and more fragile? How do you build a BIOS successor that's not complicated when it needs to allow an OS to alter boot settings for the next boot? Granted, most of what goes on in a BIOS is displaying and changing variables involved in getting the system running, and maintaining those values, which just requires some sort of minimal editing interface and nv storage, but then... users appear. They want to be able to use a mouse. They want an ability to configure their raid chipset prior to boot, or netboot, and HW makers want to implement that in a way that's not some arcane raw assembly dance between BIOS and additional chip FW. What then? I don't think the complaint is about complexity, but about code quality and architecture. This isn't the only case where an old, simpler but less capable and annoying, system has been replaced by a much more complex system that is much hated and [initially] buggy and less secure, but also more or less gets the job done better than the old way, and where average users of the new system find it easier and more productive. If there wasn't a case where a hardware manufacturer needed a capability prior to the OS taking over, or to modify their HW settings from the OS in a portable way, it wouldn't be in UEFI, right? Calling UEFI a full operating system seems needlessly inflammatory. It's not a linux or windows kernel. It has to do a fair amount of the basics, but so does any kernel running on a general purpose chip and interfacing with a bunch of other people's code. UEFI is terrible. Baseband firmwares are terrible. Security processor firmwares are terrible. AMT is terrible. Okay, but we still need them.
- blueflow 2y ago
  No, we don't need them. Look at the OpenWRT ecosystem and the routers it runs on. Those cheap plastic routers come with pretty dumb bootloaders and it works. Its just the x86 platform that is shite.