News for hackers. Stuff that matters.

A comment on How to exploit home routers for anonymity. Parent comment

Re:How to exploit home routers for anonymity by devconsole on Friday April 18, 2014 @12:16PM (#7609780)
How would you verify on demand that the BIOS isn't compromised?
[ Parent | on HN ]
Re:How to exploit home routers for anonymity by timtadh on Friday April 18, 2014 @04:13PM (#7611058)
I don't know about "on demand" but PCEngines will give the source for the BIOS and has an older version posted to the site. http://pcengines.ch/tinybios.htm
[ Parent | on HN ]
Re:How to exploit home routers for anonymity by devconsole on Friday April 18, 2014 @04:23PM (#7611112)
What I mean is, how would we verify the BIOS firmware matches what that source code should produce? If it's possible for us to make our own builds (i.e. there's no cryptographic signing for the BIOS binaries) then an adversary can insert a backdoor into the source code, make their own build, and then remotely flash your hardware with it. Or does flashing the hardware require some kind of manual operation, like holding down a button for 30 seconds?
[ Parent | on HN ]
Re:How to exploit home routers for anonymity by lurkinggrue on Friday April 18, 2014 @07:25PM (#7611851)
Could be the processors as well, better to forge the chips by hand to be sure.
[ Parent | on HN ]