Conversation

Notices

1. Embed this notice
   Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Thursday, 07-Dec-2023 08:11:33 JST Graham Sutherland / Polynomial

   UEFI getting owned by the vendor logo parser code is extremely on brand.

   Tons of time and effort put into securing platform stuff and it gets popped anyway because execs want the laptop to show the user a Dell logo for 3 seconds on boot even though it's already printed *right there on the fucking laptop*.

   • NeonPurpleStar :heart_bi:, feld and James Morris like this.
   • Embed this notice
     Ian Douglas Scott (ids1024@fosstodon.org)'s status on Thursday, 07-Dec-2023 17:45:43 JST Ian Douglas Scott

     in reply to

     • Moffin'tosh
     • LisPi

     @lispi314 @moffintosh @gsuberland Something like Ada SPARK would be suitable. Though for buffer overflows (like this seems to be) essentially every contemporary programming language would allow writing a parser without issues like that... except C and C++.

     It's not especially hard to do better here.

   • Embed this notice
     Sexy Moon (moon@shitposter.club)'s status on Thursday, 07-Dec-2023 17:45:43 JST Sexy Moon

     in reply to

     • Moffin'tosh
     • Ian Douglas Scott
     • LisPi
     @ids1024 @lispi314 @moffintosh @gsuberland replace UEFI with a BIOS that only boots the machine, like Coreboot.
   • Embed this notice
     LisPi (lispi314@udongein.xyz)'s status on Thursday, 07-Dec-2023 17:45:46 JST LisPi

     in reply to

     • Moffin'tosh
     @gsuberland @moffintosh This seems mostly useful as a persistence option.
     
     It also shouldn't be able to affect a #QubesOS system that hasn't been entirely pwn'd.
     
     It also vindicates my dislike of most image parsers & codec implementation choices, again, even more damningly than libwebp did.
     
     > The results raise a vexing question: If fuzzers identified so many exploitable vulnerabilities, why hadn’t the developers of the UEFIs (often called IBVs or independent BIOS vendors) and the OEMs selling the devices already used these tools and fixed the underlying bugs?
     Because they largely don't give a shit. We've known this for a while now.
     
     Literally none of those bugs would work if they'd written the firmware in strict Ada SPARK like they should've for something as security-critical.
   • Embed this notice
     Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Thursday, 07-Dec-2023 17:45:48 JST Graham Sutherland / Polynomial

     in reply to

     • Moffin'tosh

     @moffintosh https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

   • Embed this notice
     Tony Hoyle (tony@toot.hoyle.me.uk)'s status on Thursday, 07-Dec-2023 17:45:48 JST Tony Hoyle

     in reply to

     • penguin42

     @penguin42 @gsuberland Also.. PNG and JPEG parsers do not belong in early stage boot.

     Sexy Moon likes this.
   • Embed this notice
     Moffin'tosh (moffintosh@berserker.town)'s status on Thursday, 07-Dec-2023 17:45:49 JST Moffin'tosh

     in reply to

     @gsuberland ...context?👁️🗨️

   • Embed this notice
     penguin42 (penguin42@mastodon.org.uk)'s status on Thursday, 07-Dec-2023 17:45:50 JST penguin42

     in reply to

     @gsuberland IMHO it's more broken than that; it's not the vendors logo that's the problem (they can do that at image build time); it's that there's a way to replace that logo - e.g. for your company to do it when they buy you a laptop or for you to do it.

   • Embed this notice
     Wolf480pl (wolf480pl@mstdn.io)'s status on Thursday, 07-Dec-2023 17:46:09 JST Wolf480pl

     in reply to

     @gsuberland hey, I'm using that feature too! I want *my* logo, or a cool anime picture, to show up for 3 seconds during boot.

     Sexy Moon likes this.
   • Embed this notice
     ?? Humpleupagus ?? (humpleupagus@eveningzoo.club)'s status on Thursday, 07-Dec-2023 17:48:11 JST ?? Humpleupagus ??

     in reply to

     • penguin42
     I wonder who wanted vendors to build that feature into their machines? Probably the same company that pushed secureboot.