Slashdot Mirror
Lenovo Scrambling To Get a Fix For BIOS Vulnerability (theregister.co.uk)
Richard Chirgwin, reporting for The Register: Lenovo, and possibly other PC vendors, are exposed to a UEFI bug that can be exploited to disable firmware write-protection. If the claims made by Dmytro Oleksiuk at Github are correct, an attacker can "disable flash write protection and infect platform firmware, disable Secure Boot, [and] bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise." The reason Oleksiuk believes other vendors are also vulnerable is that the buggy code is inherited from Intel. He writes that the SystemSmmRuntimeRt was copied from Intel reference code. Lenovo complains in its advisory that it tried to make contact with Oleksiuk before he published the vulnerability. The company says the vulnerable System Management Mode software came from an upstream BIOS vendor -- making it likely that other vendors getting BIOS software from the same outlet will also be vulnerable. There's also a hint that Lenovo agrees with a speculation by Oleksiuk, that the code may be an intentional backdoor: "Lenovo is engaging all of its IBVs as well as Intel to identify or rule out any additional instances of the vulnerability's presence in the BIOS provided to Lenovo by other IBVs, as well as the original purpose of the vulnerable code."
i fully expect UEFI and secure boot to be littered with bugs, glitches, exploits, backdoors (different entities will call them different things but they're all the same.. vulnerabilities) given the nature of what it is, what it is 'supposed to do', what it actually does, how it came about, who pushed for the 'new way to do something' and the actual reasons why (hint: it isn't to protect your computers, data or interests). this "forced migration" to a new "standard" is a million times worse than the linux world's systemd thing... million times worse.
Software based firmware write protection is a joke. It is just as stupid as a door lock on a door and then hiding the key under the flowerpot on the porch.
It is no real protection at all. It should be a hardware switch like in the old days, but no, that increases the costs per device by $0.02 and it makes using the system by dumb people more difficult. Lets not do it and make an extra buck.
And because everyone reasons like this, we are now stuck with huge hardware and software stacks, which inherently cannot be secured, and an entire industry that tries just that, securing crappy systems, and failing at it.
You asked for it Lenovo and/or Intel. This turns an incoming buffer into a funciton pointer and executes arbitrary incoming code:
v3 = *(VOID **)(CommunicationBuffer + 0x20);
v4 = CommunicationBuffer;
*(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18);
That's moron. You asked for it. Now suck it up. Apologize to the world for creating a obvious backdoor.
I'm quite sure it won't be the only one coming from Intel's headquarters. And yes, security-researchers will keep digging them up and expose them. Forever.
I liked it better when I had to move a jumper before I could flash the BIOS in a machine. That was really quite secure against post-shipment BIOS modification.
Of course, I also can't think of the last time I flashed the BIOS in any of my systems, which makes me wonder why the hell we ever got away from ROMs in the first place...
A thousand pounds of wood moving at 300 feet per minute. Don't get in the way.
"Once is an accident. Twice is coincidence. Three times is enemy action."
-- Ian Fleming
We're way past three.
-- Alastair
I have never enabled the write protection on the flash. It is just an annoying feature that wouldn't do any good in protecting the machines against anything.
Also, by using this they can disable secure boot? I already disabled that to run Linux!
It even works from raw UEFI - https://github.com/Cr4sh/ThinkPwn
You've got too narrow a focus. I'd give around a 20% chance that it was an unintended error, and no more than around a 40% chance that it was the NSA. But there are lots of other "official" actors, and even gangs of criminals and discontented employees as possibilities, also.
OTOH, I, at least, realize that my estimates in this case say more about me than about the external world. I'm too ignorant to place any certainty on those probabilities, loose as they are.
I think we've pushed this "anyone can grow up to be president" thing too far.
Intel...although I'd guess money strained AMD is no better. With regards to Intel & backdoors in its chips its good to remember what we know:
http://www.infowars.com/intel-...
And don't forget what that guy at Google mentioned WRT Intel:
https://plus.google.com/+Theod...
Of course this makes all our systems vulnerable to attack by foreigners as well, but the NSA seems comfortable with that world - the country they're supposed to protect is compromised by design as long as they can spy on everyone they're okay with foreign governments being able to do that too. I would expect Microsoft's Visual Studio to be compromised by design as well.