Comment by userbinator | Hacker News Reader

Comment by userbinator | Hacker News Reader

Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper? It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise.

It was certainly "inconvenient" to perform BIOS updates, but back in those days BIOS updates weren't all that common either. I don't think it should ever be "convenient" to do something like that with basic system firmware - by its very nature, it is supposed to be stable and rarely changed. Somehow this is making me terribly nostalgic... for the days when BIOSes seemed far less buggy and in need of constant change. Now, I hear stories of laptops with factory-installed crap that silently updates the BIOS in the background(!), bricking the machine when something else unfortunate happens coincidentally with it (e.g. hard reset.) I remember the ritual of "boot from a floppy to a plain DOS prompt, run the updater, and wait for a few tense seconds as it updated the BIOS".

The mention of "Thunderbolt Option ROM" makes it clear that Thunderbolt is basically an external version of PCI(e). In other words, even without being able to modify any firmware, plenty of other maliciousness is already possible - the same with any other device that has direct access to the system bus. In the same way that you probably wouldn't plug a random untrusted PCI(e) adapter into your system, you should exercise the same caution with Thunderbolt...

I'm not sure if the jumpers were meant as a malware protection.

    [...] make it impossible for the BIOS to be corrupted 
    by software, malicious or otherwise

The jumper could enable the erase voltage for the flash. On the other hand it could also just pull up or down a pin that is queried before the flash routine does its work. For example one Intel Mobo manual[1] says explicitly the jumper protects from accidental corruption.

    Jumper JP4 controls the protection scheme that
    prevents accidental damage to or rewriting of the data
    stored in Flash memory.[1]

[1] http://www.manualslib.com/manual/77721/Intel-Iwill-P4d-N.htm...

That is an interesting example of a hybrid protection scheme - you get to choose between "software decides", "always protected", and "always unprotected". Given that the jumper is located right next to the flash, I'm inclined to believe this is a true hardware protection; likely the middle pin is connected to the write-enable of the flash, the left pin is connected to a GPIO so the software can control it, and the right pin is connected to a constant voltage to disable any writing via hardware. The open position leaves the pin free to allow writes.

Macs used to require a physical step in addition to the software setup to modify the boot ROM. I think it was something along the lines of load firmware update which initiates a reboot, after reboot press and hold the power button until there was a loud beep from the computer, then the firmware update could proceed. Not convenient, but more secure.

That's resetting the PRAM and was required on old macs for some of the fimrware changes to actually take place (since the firmware was cached).

No, resetting PRAM is triggered by holding down command-option-P-R. This was a special step that was required specifically for firmware updates.

This reminds me of the hardware switch in the original Chromebook, the cr-48, which requires you to flip a switch underneath a piece of tape before you can install an alternative operating system.

https://www.chromium.org/chromium-os/developer-information-f...

Actually, Chromebooks should be the most secure laptop platform nowadays, since every Chromebook has signed binaries and to enter in developer mode, you need some kind of switch so you can overwrite your bootloader.

Of course, this is assuming Chromebooks' bootloader doesn't have any secured problems.

Assuming that the signing key hasn't been compromised and added to an attacker's collection of keys, which is something certain three letter agencies have a habit of doing.

PowerPC Macs (in the 2000s, before the switch to Intel) did indeed require a manual step to update Boot ROM/firmware - a different mechanism than resetting the PRAM. You'd run the installer, then either shut down or reboot the Mac. As it booted, you'd either hold down the power button or the interrupt button (depending on the model) to initiate the update.

> Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper?

this is a physical access attack. when you have physical access, the game is up. (and your bios switch isn't any use).

i appreciate that inserting a thunderbolt device is easier than getting access to a switch, but it's not that much harder.

NO!

Summarizing as “when you have physical access, the game is up” is the same as saying that employees who pick up abandoned USB thumbdrives on parking lots and plug them into work computers are guilty.

Plugging things in are what Thunderbolt/USB ports are FOR. This is how you transmit data and how you extend the computer with new peripherals. It may be impossible to prevent a Thunderbolt or USB peripheral from bricking the computer, but that doing so can end up giving control of it to a third party is an unacceptable security failure, is not the user's fault, and needs to be fixed.

A physical hardware switch located inside the box would be quite appropriate. Everyone knows that you don't need to open the computer to read from an external drive.

> is the same as saying that employees who pick up abandoned USB thumbdrives on parking lots and plug them into work computers are guilty

oh my science they most certainly are.

> Plugging things in are what Thunderbolt/USB ports are FOR

yes, but the moment you insert them into a machine they are assumed to be trusted. (this is my opinion, it could be incorrect)

> the same as saying employees who pick up abandoned USB thumbdrives on parking lots and plug them into work computers are guilty

This has been true for as long as USB has existed. The broader version -- "don't attach untrusted hardware" -- has been true for as long as there have been computers.

There is a reason secure installations do not allow employees to bring in arbitrary electronics.

>Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper?

Remember how that was only for a short 1-2 years as a knee jerk reaction to CIH virus?

Older PCs had bios in EPROM (UV window on the chip) instead of EEPROM. That was the only physical protection. Later Intel introduced firmware hub (FWH) with software protection against flashing (you had to unlock certain memory region/io access), then we got SPI flash chips with some copy protection (again software controlled).

Jumper was a short lived, useless (after the fact) feature that died because nobody needed/wanted/asked for it.

Reply on news.ycombinator.com