Hacker News Reader

Comment by cjbprime | Hacker News Reader

> System76 will automatically deliver updated firmware with a disabled ME

Having the ability to automatically push new firmware of your own creation to customers' machines is more power than you ought to want. My security threat model as a System76 customer shouldn't have to include you (perhaps with you being hacked or coerced) pushing me malware that's undetectable to my OS after it's been installed.

Please reconsider this feature (of automatic firmware updates). Firmware updates are rare enough that it should be fine for them to be explicitly opt-in. It's great to want to make Intel's firmware more secure. But replacing Intel as a possible attack vector with yourselves is strictly worse for the machine's security.

View on HN

System76 employee here. I suppose the "automatic" could be re-worded; the data is automatically pushed to the machine but then the user always opts into the actual install.

But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place. These updates are signed and verified with industry best practices.

jackpot51 (the System76 engineer currently working on this) could probably detail it better than I can, though.

Is the user intervention required to install the firmware or do you still have the capability to install it without asking? Just because you ask for permission now does not mean that you have to.

Why push the firmware before asking?

I asked David Jordan, the engineer working on the firmware updater.

>Not only aren't updates initiated without permission, I wrote the code to make that literally impossible without changes to the installed python code.

The code is available at https://github.com/pop-os/system76-driver and https://github.com/system76/firmware-update

Thanks for the reply! So you can push an update to the python code that allows you to push an update to the firmware without prompting? Sounds like we still rely on the security of your systems to prevent malicious firmware from being pushed.

Well... yeah? They're the OS vendor; there is literally no way for them to do their job without having the ability to update the system.

Yes they have to be able to update the system but in this case they are also able to update the firmware without asking which means anyone who can impersonate or coerce them can also update the firmware.

If you control the OS, you also control the firmware (if you want a way to install new firmware from the OS). No way around.

Since the firmware updater is a Python program, you can audit the source code by looking at the relevant directory in site-packages before you accept. If you're really paranoid you can set up a periodic script that sends you an email if the contents of that directory change.

How deep does the rabbit hole of trust go...

All the way to the mask set.

How does this work anyway? Just a thing in the pre-installed OS that won't be there if a new OS is installed?

This sounds pretty good. But just to finish exploring this:

> But on the other hand, System76 customers are trusting that System76 hasn't been hacked or coerced to ship malicious firmware from the factory in the first place

I think it's reasonable to feel differently about those two risks.

Most notably, you only get one chance to load malware at the factory, whereas you have an infinite number of chances to push malware as a software update after that. It's harder for you to avoid being compromised forever than to avoid it at one specific moment. One person on your team could probably get malware signed and distributed as an targeted update without anyone else knowing, whereas doing it in the factory might take more coordination.

It's also tidier from an attacker's perspective to deliver malware just-in-time to a specific user, rather than to everyone, or to a machine that you hope will end up in the hands of the target weeks/months later. It's less detectable.

If you have a way to avoid being able to infer (e.g. by their IP address, correlated with other records) which human is asking for a firmware update file (or any update file) at the time it's downloaded, I recommend taking steps to deny yourself that knowledge.

It is delivered through the PPA that you enable after trusting system76. So I don't know where this reasoning is comes from. Also updates in Ubuntu are delivered only after the user explicitly invokes it(in GUI or using apt).

Afaik the standard setup of Debian and Ubuntu is to install UnattendedUpgrades with automatic periodic installation of security updates. These aren't supposed to come with functional changes beyond patching security bugs, but there's no theoretical reason a security-patch couldn't bootstrap netbsd and change the entire os. It's code that runs as root.

To be clear: I think this is a great default configuration, and it's been a long time coming - but it's just not true afaik that Debian/Ubuntu won't auto-update at all in the default configuration.

[ed: Debian: https://wiki.debian.org/UnattendedUpgrades

"As of Debian 9 (Stretch) both the unattended-upgrades and apt-listchanges packages are installed by default and upgrades are enabled with the GNOME desktop."]

Reply on news.ycombinator.com