Lenovo Scrambling To Get a Fix For BIOS Vulnerability (theregister.co.uk) 59
Richard Chirgwin, reporting for The Register: Lenovo, and possibly other PC vendors, are exposed to a UEFI bug that can be exploited to disable firmware write-protection. If the claims made by Dmytro Oleksiuk at Github are correct, an attacker can "disable flash write protection and infect platform firmware, disable Secure Boot, [and] bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise." The reason Oleksiuk believes other vendors are also vulnerable is that the buggy code is inherited from Intel. He writes that the SystemSmmRuntimeRt was copied from Intel reference code. Lenovo complains in its advisory that it tried to make contact with Oleksiuk before he published the vulnerability. The company says the vulnerable System Management Mode software came from an upstream BIOS vendor -- making it likely that other vendors getting BIOS software from the same outlet will also be vulnerable. There's also a hint that Lenovo agrees with a speculation by Oleksiuk, that the code may be an intentional backdoor: "Lenovo is engaging all of its IBVs as well as Intel to identify or rule out any additional instances of the vulnerability's presence in the BIOS provided to Lenovo by other IBVs, as well as the original purpose of the vulnerable code."
NSA Strikes Again! (Score:1)
:(
Re: (Score:2)
90% of all quotes on the Internet are discredited.
--Zhou Enlai
Re: (Score:1)
Yeah, and he's wrong [cia.gov] too.
Re:NSA Strikes Again! (Score:5, Informative)
"Once is an accident. Twice is coincidence. Three times is enemy action."
-- Ian Fleming
We're way past three.
Re: (Score:2)
"Once is an accident. Twice is coincidence. Three times is enemy action."
-- Ian Fleming
We're way past three.
Close, and with correct attribution. "Once is happenstance..." not "an accident."
Re: (Score:3)
http://www.infowars.com/intel-... [infowars.com]
And don't forget what that guy at Google mentioned WRT Intel:
https://plus.google.com/+Theod... [google.com]
Of course this makes all our systems vulnerable to attack by foreigners as well, but the NSA seems comfortable with that world - the country they're supposed to protect is compromised by design as long as they can spy on every
Re: (Score:1)
"Never assume malice when stupidity will suffice"
-- Bill Gates
What I love about your choice of Bill Gates for this is he's exactly the person who would want people to belive something like that, even the 100th time round. In fact, when I think of Borland, NCSA, Netscape, Danger Ericsson, Sendo, the PlaysForSure partners and Nokia, Bill Gates should be allowed to claim the quote as his own through being the most dedicated user in history even if he didn't come up with it himself.
Re: (Score:2)
I first saw that quote attributed to Napoleon Bonaparte.
Re: (Score:2)
newer isn't always better. (Score:2)
i fully expect UEFI and secure boot to be littered with bugs, glitches, exploits, backdoors (different entities will call them different things but they're all the same.. vulnerabilities) given the nature of what it is, what it is 'supposed to do', what it actually does, how it came about, who pushed for the 'new way to do something' and the actual reasons why (hint: it isn't to protect your computers, data or interests). this "forced migration" to a new "standard" is a million times worse than the linux wo
Re: (Score:1)
That's what I have concluded due to my experience too.
UEFI is not to protect everybody from Boot viruses or rootkits, but to protect the interest of commercial OS and backdoored Linux releases.
With UEFI you cannot use your laptop peripherals if you boot with the classic BIOS (by disabling UEFI), and you cannot install old versions of Windows due to signature requirement. Also, what's irritating is, you cannot compile your own Kernel anymore because you will be forced to boot on classic BIOS without your
Re: (Score:2)
I must say, I have yet to see a genuine improvement offered by UEFI. It looks like it's all downside from the consumer standpoint.
Re: (Score:3)
You've got too narrow a focus. I'd give around a 20% chance that it was an unintended error, and no more than around a 40% chance that it was the NSA. But there are lots of other "official" actors, and even gangs of criminals and discontented employees as possibilities, also.
OTOH, I, at least, realize that my estimates in this case say more about me than about the external world. I'm too ignorant to place any certainty on those probabilities, loose as they are.
Software based firmware write protection is a joke (Score:5, Insightful)
Software based firmware write protection is a joke. It is just as stupid as a door lock on a door and then hiding the key under the flowerpot on the porch.
It is no real protection at all. It should be a hardware switch like in the old days, but no, that increases the costs per device by $0.02 and it makes using the system by dumb people more difficult. Lets not do it and make an extra buck.
And because everyone reasons like this, we are now stuck with huge hardware and software stacks, which inherently cannot be secured, and an entire industry that tries just that, securing crappy systems, and failing at it.
Re: (Score:2)
It is just as stupid as a door lock on a door and then hiding the key under the flowerpot on the porch.
Actually as stupid as a store with gates on its windows and door glass but the front door lock has a twist handle on the inside. Break the glass and open the door...
Re: (Score:1)
not really, since part of having your apartment broken into is KNOWING its been broken into.
key + flowerpot nicely obscures the hack.
whereas broken glass everywhere is a pretty good sign that something has been taken.
Remember; you can't actually prevent someone sufficiently motivated from getting in your house (Axe/sledgehammer/Car will bust pretty much any security measure). But the more destructive they have to be; the more likely the forced entry will be detected.
In the absence of complete security; you
Nobody Seems To Notice and Nobody Seems To Care (Score:1)
Nobody Seems To Notice and Nobody Seems To Care - Government & Stealth Malware
In Response To Slashdot Article: Former Pentagon Analyst: China Has Backdoors To 80% of Telecoms 87
How many rootkits does the US[2] use officially or unofficially?
How much of the free but proprietary software in the US spies on you?
Which software would that be?
Visit any of the top freeware sites in the US, count the number of thousands or millions of downloads of free but proprietary software, much of it works, again on a prop
Re: Nobody Seems To Notice and Nobody Seems To Car (Score:1)
I have ONE word for you... BREVITY!!
I'm not reading any post that long, and I doubt many others will as well
Why I am not surprised by this (Score:2)
Not surprised about this at all. A few simple reasons /.) about the company that was doing all sorts of pop-up ad's for a camera (ax-90 or something like that), had an interview with the chief programmer. He stated very specifically that his line was drawn when they figured they could hack the bio's and
A) Analog (Sci-fi/fact in the 80's) corporate warfare by making chips have vulnerabilities published more than once
B) in the last 11 years ( don't recall exactly ) , a published report ( also posted here in
So this "better replacement for BIOS"... (Score:1)
... turns out to not really be better at all. More complexity, more bugs, more features nobody really needs, more enhancements that don't actually do what they're billed to do, more "security" that isn't, more dependency pressure on downstream users and dependent OSes, and more security vulnerabilities courtesy itself, yes. Actually better, no.
Pretty impressive.
Executing code in a input buffer? yeah, suck it up (Score:5, Informative)
You asked for it Lenovo and/or Intel. This turns an incoming buffer into a funciton pointer and executes arbitrary incoming code:
v3 = *(VOID **)(CommunicationBuffer + 0x20);
v4 = CommunicationBuffer;
*(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18);
That's moron. You asked for it. Now suck it up. Apologize to the world for creating a obvious backdoor.
I'm quite sure it won't be the only one coming from Intel's headquarters. And yes, security-researchers will keep digging them up and expose them. Forever.
Re: (Score:2)
That's moron.
"Moronic," moron. :-)
Re: (Score:1)
IDA pro is not exactly AI. It just "reverses" every machine code instruction to C. In the original machine code, it is probably just a CPU register.
You know what flashing a BIOS secure? (Score:5, Insightful)
I liked it better when I had to move a jumper before I could flash the BIOS in a machine. That was really quite secure against post-shipment BIOS modification.
Of course, I also can't think of the last time I flashed the BIOS in any of my systems, which makes me wonder why the hell we ever got away from ROMs in the first place...
Re: (Score:2, Interesting)
They can flash all they want... but that jumper is both less work and much more secure. You can point to it and check that it's put right. Software can much more easily lie, much more easily than poorly visible traces on a multi-layer pcb. Crypto is cute and all that, but all it does in UEFI/"SecureBoot" is take away control, without actually bringing any security to the end user. That puts the whole thing firmly in the "make-work for the end-user" (and another nice little consulteering racket for the secur
Re:You know what flashing a BIOS secure? (Score:5, Interesting)
I liked it better when I had to move a jumper before I could flash the BIOS in a machine. That was really quite secure against post-shipment BIOS modification.
A good thought but it doesn't work so well when you've got hundreds or thousands of remotely supported systems scattered over the city/country/continent/planet.
Of course, I also can't think of the last time I flashed the BIOS in any of my systems, which makes me wonder why the hell we ever got away from ROMs in the first place...
You know this article is about shitty code, right? Well, I can tell you that the BIOS being shipped these days is shitty in more ways than this. If you have enough machines out there, you will sooner or later encounter something strange that involves a bug in firmware. From a mouse/printer/USB-vibrator to the latest DVI/HDMI/DisplayPort monitor, sooner or later you'll plug something in and it won't work as advertised. Or something that used to work stops working because... reasons. Basically, if you accept that there are firmware updates for motherboards, you should accept that there are reasons for them existing, even if you haven't needed them.
And don't get me started on the shitty code in server firmwares.
Most commercial systems (Dell, Lenovo, HP) they're bugfixes. Most consumer systems (Asus, Gigabyte, etc) they're updating support for processor microcode or memory module compatibility or whatever.
Re: (Score:1)
I liked it better when I had to move a jumper before I could flash the BIOS in a machine. That was really quite secure against post-shipment BIOS modification.
A good thought but it doesn't work so well when you've got hundreds or thousands of remotely supported systems scattered over the city/country/continent/planet.
The part where you're remotely flashing is really but a very small part in all that. Take, say, ATMs. They run windows, have holes up the ying-yang, get "pwned" merely by plugging in an USB device*, and so on, and so forth. Flashing isn't going to help there.
I've argued elsewhere that such a thing is one of the few places where I'd condone TPM and "secure" boot, in fact it'd be fully justified there**, and even then the better way to do maintenance is to send a replacement board rather than trying to do rem
Re:You know what flashing a BIOS secure? (Score:5, Insightful)
I liked it better when I had to move a jumper before I could flash the BIOS in a machine. That was really quite secure against post-shipment BIOS modification.
Of course, I also can't think of the last time I flashed the BIOS in any of my systems, which makes me wonder why the hell we ever got away from ROMs in the first place...
Dear guys:
You seem to not realize how servers and cloud influence general computing. Intel, RedHat and many other companies do make the bulk of their income and profits from servers, therefore, servers are first, second and third.
That's why you got UEFI in the first place, and that's why UEFI has provisions for:
- Remote connections.
- Ethernet boot.
- etc.
Jumper to change the FIRMWARE?
Yeah, like that's going to work when your server count is in the couple of thousands... (also, not for a desktop/laptop fleet, but that's a different story).
sytemd is another example. Does anyone really believes that "RedHat is shoving the desktop down our throats"?
- You need to boot faster your cloud servers for elasticty's sake.
- Also, you need to boot faster if your preferred remedy for failures is to freze the VM for latter analisys, and spin up another instance.
- You need to shotdown machines fast when the work peak is over, in order to release resources fast, and not to overcharge the customer (if on public cloud).
- If your servers/virtual machines are controlled by another machine and not by a human, what do you preffer, configure a centralized repository of values via an API (like on VMS and 'gulp' Windows' registry*)? Or having to parse a rag-tag fleee of config files, each with "a slightly different syntax"**?
I guess you can see the drift from here...
* I am not saying that the IMPLEMENTATION of the Windows Registry is right. What I am saying is that the IDEA of a Centralized Repository Of System Configuration Info Accessible Trough An API is good. Again, see VMS.
** Even though for us humans the syntax of most config files seems the same, for other machines one config file is ussaly completely different from the other...
Re: (Score:2)
That's why you got UEFI in the first place, and that's why UEFI has provisions for: - Remote connections. - Ethernet boot. - etc.
We already had those with the old BIOS.
As for systemd, startpar already booted faster, as did a number of other modifications to SysV. Same for fast shutdown. We already have tools like puppet and company for deploying config files.
For fleets of servers, I wouild rather do the re-flash and then disable flash writes during the commissioning process (assembly line style if you have a lot of new servers to put online) rather than wonder what happens if someone wipes a bunch of servers in a single stroke one ni
Re: (Score:3)
I upgraded my PC around xmas with a Gigabyte Skylake motherboard and I had to upgrade to the latest BIOS revision before Fallout 4 (the reason I bought the upgrades in the first place) would run without crashing.
I do agree that a physical switch for the BIOS write protection would be a good idea.
Just like Intel's IME root-kit... (Score:1)
Not sure I care or should care (Score:3)
I have never enabled the write protection on the flash. It is just an annoying feature that wouldn't do any good in protecting the machines against anything.
Also, by using this they can disable secure boot? I already disabled that to run Linux!
It's not a bug (Score:1)
it's a back-door, and back-doors do not build and insert themselves into structures. When NSA delivers the court orders to Intel, they abide, deny, and otherwise don't speak a word of it. This is how it works with U.S. technology these days.
Re: (Score:2)
it's a back-door, and back-doors do not build and insert themselves into structures. When NSA delivers the court orders to Intel, they abide, deny, and otherwise don't speak a word of it. This is how it works with U.S. technology these days.
On the other hand, the less people that know about "it" the better. That way no one talks about locked doors in San Francisco phone intererchanges and the such....
Just win10? Or Linux as well? (Score:2)
Re: (Score:2, Informative)
It even works from raw UEFI - https://github.com/Cr4sh/ThinkPwn
HA! Firmware! Just went limp. (Score:1)
Put the BIOS on ROM, on a sim card so it can be replaced dammit! And while we're on the subject, why isn't the OS on a read only chip also? Mine is. It's "live"