Hacker News Reader

Comment by legalcorrection | Hacker News Reader

>the smallest percentage are willing to update firmware

Not commenting on the broader issue, but this attitude has to change. Firmware updates cannot be seen as optional anymore.

View on HN

Firmware should have a physical switch to enable updating it. Fuck self checked signatures. There, fixed all the BIOS and firmware exploits for you. You're welcome.

That only works for IT-managed devices (and even then, is very expensive in terms of labor). Consumer devices need auto-update to protect them from known vulnerabilities. Auto-update is hard to get right, but your product is defective by design if it doesn't support it.

You can auto-update AND tell the user to flip the switch as part of the update process.

It is possible https://hackernoon.com/how-the-nintendo-switch-prevents-down...

Firmware vulnerabilities aren't necessarily used to target the firmware or to try to gain persistence - vulnerabilities in SMM handlers, for instance, can be used for privilege escalation at runtime.

That is true, but disabling firmware update (should) limit the available persistence for the malware.

Limit, but it doesn't remove all avenues of attack. Firmware config needs to be writable at runtime (things like cold boot attack protection require state to persist over power cycles, even if you don't think other firmware config should be modifiable without physical presence), and the code that parses that could still contain vulnerabilities. Making firmware mostly read-only would mitigate certain classes of attack, but not all of them.

Perfect is the enemy of good enough.

I'm responding to "There, fixed all the BIOS and firmware exploits for you". It doesn't actually fix all the potential exploits, and it makes it more difficult to apply the updates that would be required to fix them.

Fair enough. That last bit is a really good point.

That will be a problem for lots of centrally managed, distributed networks, like point of sale machines managed by a central entity.

"For every complex problem, there is a solution that is simple, neat, and wrong"

Popular rephrasing of the H.L. Menckin original.

https://quoteinvestigator.com/2016/07/17/solution/

Sometimes firmware updates make the system worse or even completely bricked. If the machine already working and stable, I've learned it's a risky / bad idea to eagerly apply firmware updates.

Flash media is cheap nowadays, and HP EliteBook series laptops store a couple of previous BIOS versions on board to make rollback possible. Also these higher end laptops can try previous version of their firmware if they fail to boot with the latest one.

Failing to see how Lenovo can't implement something like that.

I know my ThinkPad gives me a "self-healing BIOS" message whenever I update the firmware (on a side note, fwupd is amazing), which according to Lenovo's Twitter is a BIOS backup (https://twitter.com/lenovo/status/1297785406239514624?lang=e...).

Bad idea because firmware bugs are a growing attack vector and you are leaving yourself exposed to known, easily-exploited vulnerabilities by not staying up to date.

Reply on news.ycombinator.com