Hacker News Reader

Comment by jonwachob91 | Hacker News Reader

T450S user here. What exactly does this mean for me? I get it's a security issue, but that's about all I understood...

The attack against you would be interdiction, where the NSA (or whomever) would MITM shipping and receiving.

What shipping and receiving? Somewhere between where you will receive the package -- be it your home, PO Box, postal office, etc -- and the originating storage facility (ie: warehouse), there is a long list of hands exchanging your product. One of these hands would be an NSA agent's hands.

https://en.wikipedia.org/wiki/Interdiction

Who is targeted? In all likelihood, businesses, but I'm sure individuals are targeted as well.

The attack requires physical access to the hardware.

And just to be clear -- it's not just Lenovo products. The net seems to have been cast much wider and other devices seem to be affected (HP laptops, desktop motherboards).

I'm sure the NSA has other ways of bypassing security of the proprietary firmware (likely even through the front door), so this single exploit doesn't really add to that threat.

What it hopefully does do is cast a little ray of light on this suite of user-hostile firmware, helping us expunge this long present software muck that, for example, allows such interdiction attacks to be so easy.

The example exploit is run from an UEFI shell which requires physical control of the device. It mentions exploitation from the OS as a possibility however one would expect that the OS shouldn't allow such operations as a non root user.

Sure, but there's not exactly a shortage of privilege-escalation exploits around. It doesn't seem like this is exactly a drive-by "oh please look at this resume.rtf.doc" type of attack, but it could become one with time if it goes on too long. Somebody would just need to stack things up in the right way, to get privileges in the OS and then from there inject the EFI code. That'd be a heck of a rootkit.

Typically physical control is deemed as the game ender. If this is proven to be OS executable it will be a major issue. Many of the Adobe, IE, and other high volume exploit vendors codebase zero-day root exploits would allow one to not only gain access at a root level on a machine, but now also at a much lower level. This level would negate the typical benefits of recovering from a root-level "hack" via HDD erasing or Malware Removal tools or any other method available to even tech-savvy people.

It very probably is (on non secure boot systems). The EFI system partition is just a FAT32 partition that can be mounted e.g. using mountvol. The EFI boot options and order are stored in changable variables (see efiboootmgr). Writing this code to ESP and setting it up to run on next boot then chainload windows doesn't sound too hard.

Reply on news.ycombinator.com