Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google
Replace Your Exploit-Ridden Firmware with Linux - Ronald Minnich, Google on HackerTube: recommended by 6 Hacker News commenters across 4 separate months, 2017–2023.
Ronald Minnich of Google explains how UEFI firmware is a large closed attack surface and describes Google's work replacing it with Linux-based boot firmware. It also touches on Intel ME and other security coprocessors.
What HN commenters said
12 Hacker News comments link this video. Each one links back to its thread.
anonym29Apr 2023Strongly recommends
Intel CSME (formerly ME) and AMT ST (formerly PSP) have many properties that are / would be desireable for someone who is/was building a backdoor (DMA, TCP/IP stack that can use onboard ethernet without the host OS being aware, closed source, unremovable, etc). Keep in mind that even if there has not been a backdoor deliberately added, there absolutely have been serious exploits in ME and PSP, and even for those who are not worried about the government, these security coprocessors still pose grave risk to data privacy and security, potentially handing "ring -3" access to non-government hackers. While I personally share your belief that these are probable backdoors, it is important to remind skeptics that they pose a grave security and privacy threat even outside the context of a government backdoor conspiracy. There's a great talk on the risks posed by the capabilities of these security coprocessors by an extremely well-versed individual at Google who was (leading? involved at a high level?) working on Google's efforts to neutralize these dangerous subsystems at Embedded Linux Con in 2017: ▶ this video
in “GNU+Linux laptops with Libreboot preinstalled, based on coreboot” · View on HN
SEJeffNov 2017Strongly recommends
Absolutely fantastic video from a google engineer (and the original author of LinuxBios / Coreboot) on how they replaced the UEFI firmware with Linux to get Dell servers to boot in 20 seconds: ▶ this video
in ““We have obtained fully functional JTAG for Intel CSME via USB DCI”” · View on HN
ignoramousMar 2023Recommends
The gist is (which doesn't hold universally true), when the CPU is powered up, it initializes its internal RAM, loads in a pre-boot ROM, executes it. pre-boot ROM's job is to initialize whatever it has to, to bring in the initial bootloader which initializes RAM, finds a suitable bootloader program and loads it in. This program, also called second-stage bootloader , is an Operating System in its own right. It can understand filesystems, explore attached hardware, speak multiple network protocols, initialize devices as needed. The second-stage bootloader (there may also be a third-stage ) usually then boots into a Kernel. The Linux Kernel invokes the init process and things proceed into the userspace from there. At each of those stages, the bootloader images, the kernel image, the device trees, and the disk / filesystem are verified ("measured") for integrity eventually anchored on a "hardware root-of-trust". If you're a visual learner: How TI Beagleboard boots (33m): [link] / [link] How ARM Cortex M boots (9m): [link] / [link] Bootloader 101 (embedded devices; 38m): [link] / [link] Measured Boot (39m): [link] / [link] Coreboot (38m): ▶ this video / ▶ this video U-Boot (1h 25m): [link] UEFI for U-Boot (38m): [link] / [link] Device Trees (43m): [link] / [link] ARM Trust Zone (46m): [link]
in “Ask HN: Where can I find a primer on how computers boot?” · View on HN
watersbJul 2018Recommends
There seems to be confusion about vPro, AMT, BIOS, UEFI, Trusted Boot, and so on. This talk helped me: "Replace Your Exploit-Ridden Firmware with Linux" ▶ this video
in “Intel patches new ME vulnerabilities” · View on HN
mmcclellanNov 2017Recommends
I first heard the Minix thing in this talk: ▶ this video which I found, I think via a HN thread. Anyway, most of the articles rehash this talk and IMO its a solid 30 minute investment.
in “An Open Letter to Intel” · View on HN
jjevanoorschotNov 2017Recommends
A recent talk [0] by Ronald Minnich from Google gives a nice overview of their efforts to replace parts of Intel ME and UEFI with Linux, mostly for security reasons. [0] ▶ this video
in ““We have obtained fully functional JTAG for Intel CSME via USB DCI”” · View on HN
Show 6 more comments
joezydecoFeb 2022Cites it
Intel had an opportunity to develop Zephyr as a usable RTOS, internally* and externally. If they thought that the technology was compelling, why did they let it go? *(Intel's Management Engine is still around, running....Minix. ▶ this video )
in “Intel energizes decades-old real-time Linux kernel project” · View on HN
matheusmoreiraJul 2018Cites it
They run in ring -2. Proprietary software with networking stacks, file systems, device drivers, web servers, all running in a mode more privileged than the operating system. There's also the Intel Management Engine with pretty much the same features but running in ring -3. ▶ this video
in “Uefi-jitfuck – A JIT Brainfuck compiler running on x86_64 UEFI” · View on HN
josteinkMar 2018Cites it
> As someone who's worked in the consumer electronics industry for years, I think we desperately need to rethink our approach to Linux-based electronics with respect to both the userland and the primary application. Google has created a stack called NERF (Non-Extensible Reduced Firmware) for this: [link] There's a presentation about it on youtube: ▶ this video
in “Gokrazy: A pure-Go userland for Raspberry Pi 3 appliances” · View on HN
jstewartmobileDec 2017Cites it
Why so many haters? Just the fact that they've got Ron Minnich[0-1] on the team--one of the guys fighting the good fight against all of the voodoo BS in your Intel/AMD firmware--makes it worth a look IMHO. [0] ▶ this video [1] [link]
in “Harvey – An effort to provide a modern, distributed, 64-bit operating system” · View on HN
trendiaDec 2017Cites it
There were investigating flashing the ME for their compute cloud processors [0] to avoid the possibility of an ME vulnerability being exploited, which would greatly harm their reputation. [0] ▶ this video
in “How to hack a turned-off computer, or running unsigned code in Intel ME [pdf]” · View on HN
wolfgkeNov 2017Cites it
> Is this related to Purism announcing that they had successfully disabled the Intel Management Engine on their laptops? Or is that unrelated? It is completely unrelated. Intel ME is about a remote servicing interface that exists on all current Intel processors. While it has some usages for managing computers in a corporate setting or managing servers (keyword to look for: Intel Active Management Technology (Intel AMT), which needs Intel vPro), it exists on nearly all current Intel processors (except, I think, Intel, Quark; but this processor is built for completely different purposes). Thus there are rumors that it is a backdoor for, say, 3-letter agencies. I don't want to spread any rumors here, but just say: Because Intel ME is very large and complicated (according to ▶ this video 5 MB in size) it is a real concern that lots of security gaps will be found (and some have been found in the past), which, because of Intel ME's structure (according to [link] it runs on ring -3) can easily lead to really dangerous security holes. Just for this reason alone any responsible admin should try to disable Intel ME so that this security liability does not have to stay open. PRISM is a surveillance program by the NSA.
in “Forget iPhone X–Apple's Best Product Is Its Privacy Stance” · View on HN