Re:Researchers crack open malware that hid for 5 years
by mikeash on Tuesday August 09, 2016 @09:56PM
(#12259019)
Make it a button, so the customer can apply updates, but they need to press a button to make it happen. Add another button which, using only software stored in ROM, reloads the firmware from ROM. Then you have updates, but only when the customer knows and wants it, and if they ever screw it up then they can get back to a known good state.
[ Parent
| on HN ]
Re:Researchers crack open malware that hid for 5 years
by Const-me on Wednesday August 10, 2016 @08:51AM
(#12261249)
The customer has no way of knowing whether they are installing genuine update, or MITM-modified malicious update.
Public key cryptography solves that but then you have a problem how to protect the keys and crypto algorithms from tampering.
Update buttons ain't a good replacement for TPM hardware.
Re:Researchers crack open malware that hid for 5 years
by WalterBright on Wednesday August 10, 2016 @03:12PM
(#12264125)
It's an enormously harder problem to convince the customer to push the "update firmware" button on the front panel than it is to insert malware remotely without any action or knowledge on the customer's part.
Re:Researchers crack open malware that hid for 5 years
by Const-me on Thursday August 11, 2016 @02:37PM
(#12270636)
It’s enormously easier problem to exploit a well-known remote code execution vulnerability, that’s unpatched because updates are too easy to ignore.
For the end user, it’s extremely easy to NOT push that button.
Re:Researchers crack open malware that hid for 5 years
by mikeash on Wednesday August 10, 2016 @10:55AM
(#12262205)
It's not a panacea, but nothing is, and it would help a lot. It's not supposed to be a replacement for anything, just an addition.
Re:Researchers crack open malware that hid for 5 years
by WalterBright on Tuesday August 09, 2016 @11:18PM
(#12259302)
Yup, that's the way to do it.