Meta tags:
description= Hastily-written news/info on the firmware security/development communities, sorry for the typos.;
Headings (most frequently used words):
uefi, firmware, security, and, to, secure, boot, intel, for, from, common, with, on, dell, bios, updates, microsoft, code, duktape, fujitsu, redfish, samples, end, coreboot, platform, in, considerations, follow, p2im, scalable, hardware, independent, testing, via, automatic, peripheral, interface, modeling, sentinal, labs, moving, sense, knowledge, about, actually, dumping, anvil, ventures, defeating, symlink, attacks, acpiparse, utility, which, prints, info, acpi, tables, pfs, assembler, script, that, modifies, be, downgrade, able, 18, advisories, zmk, modern, open, source, keyboard, engineering, data, breach, including, internals, offers, dbx, guidance, defn, third, plugin, visual, studio, port, of, the, embeddable, javascript, engine, boothole, grub, vulnerability, irmc, scripting, modular, framework, embedded, systems, address, sanitizer, integration, arm, apple, checklists, overlaps, gaps, fwts, ported, risc, potential, verified, support, barbara, iot, new, os, ibm, policy, based, governance, trusted, container, ietf, draft, richardson, secdispatch, idevid, 01, operational, manufacturer, installed, keys, anchors, disclaimers, us, search, tags, archives, blogs, only, shows, first, 50, posts, navigation,
Text of the page (most frequently used words):
the (154), #security (100), intel (94), firmware (82), for (75), https (71), com (58), and (54), news (48), info (47), development (46), hastily (44), #written (44), communities (44), sorry (44), typos (44), www (42), 2020 (41), advisory (38), blog (37), uefi (30), html (22), comment (21), august (21), content (20), leave (20), hucktech (20), org (19), july (19), boot (19), center (19), blogs (18), that (18), secure (17), with (16), this (15), 2019 (15), github (14), there (14), from (13), 2016 (13), microsoft (13), has (13), 2017 (12), 2018 (12), devices (12), risc (11), new (11), fujitsu (11), coreboot (10), project (10), arm (10), are (10), their (10), hardware (10), linux (9), platform (9), 2015 (9), not (9), based (8), software (8), oracle (8), redfish (8), which (8), works (8), support (8), framework (8), code (8), rss (7), device (7), may (7), windows (7), bios (7), ietf (7), embedded (7), can (7), systems (7), testing (7), source (6), planet (6), search (6), ibm (6), android (6), april (6), june (6), chipsec (6), posts (6), about (6), how (6), verified (6), test (6), lists (6), more (6), list (6), update (6), duktape (6), have (5), other (5), feed (5), freebsd (5), september (5), october (5), november (5), december (5), january (5), february (5), march (5), iot (5), fwts (5), data (5), port (5), also (5), but (5), issues (5), modules (5), our (5), server (5), dbx (5), zmk (5), peripheral (5), p2im (5), site (4), just (4), enterprise (4), open (4), ubuntu (4), trust (4), page (4), first (4), apple (4), amd (4), use (4), working (4), anima (4), any (4), colinianking (4), tests (4), address (4), part (4), updates (4), samples (4), including (4), grub (4), vulnerability (4), dump (4), tmk (4), qmk (4), keyboard (4), series (4), dell (4), common (4), you (3), view (3), wordpress (3), lenovo (3), developer (3), linaro (3), debian (3), red (3), hat (3), reverse (3), engineering (3), cyber (3), developers (3), home (3), only (3), edk2 (3), acpi (3), tools (3), datatracker (3), draft (3), considerations (3), keys (3), time (3), all (3), out (3), article (3), found (3), web (3), colin (3), suite (3), ported (3), work (3), today (3), wiki (3), using (3), firmwaresecurity (3), some (3), research (3), these (3), information (3), one (3), should (3), might (3), makes (3), acs (3), docs (3), run (3), useful (3), sanitizer (3), fpga (3), irmc (3), sample (3), access (3), been (3), third (3), plugin (3), visual (3), studio (3), guidance (3), interface (3), dev (3), mechanical (3), while (3), real (3), wireless (3), acpiparse (3), symlink (3), refresher (3), spi (3), flash (3), memory (3), manage (2), log (2), sign (2), subscribed (2), subscribe (2), bunnie (2), purism (2), system76 (2), edu (2), community (2), sage (2), asset (2), intertech (2), intelligence (2), kali (2), ixsystems (2), inc (2), storage (2), servers (2), tizen (2), standards (2), multiple (2), categories (2), fedora (2), people (2), opensuse (2), xen (2), fsf (2), foundation (2), bootlin (2), discover (2), official (2), bsd (2), iotivity (2), replicant (2), executive (2), cisco (2), möbius (2), strip (2), msdn (2), rapid7 (2), threatpost (2), product (2), incident (2), response (2), team (2), schneier (2), nvm (2), express (2), malwarebytes (2), sniablog (2), w00tsec (2), broadcom (2), connectedbroadcom (2), connected (2), chromium (2), llvm (2), follow (2), shows (2), 112 (2), archives (2), usb (2), tpm (2), macos (2), canonical (2), sponsored (2), preos (2), disclaimers (2), documents (2), richardson (2), secdispatch (2), idevid (2), provides (2), private (2), public (2), anchors (2), group (2), technologies (2), was (2), each (2), day (2), secl (2), cloud (2), computing (2), cases (2), policy (2), governance (2), trusted (2), container (2), discussing (2), txt (2), raise (2), level (2), your (2), barbaraiot (2), guessing (2), closed (2), requires (2), name (2), given (2), unclear (2), operating (2), system (2), called (2), barbara (2), ian (2), king (2), fosstodon (2), off (2), http (2), between (2), centric (2), except (2), nothing (2), defender (2), presume (2), does (2), unknnown (2), documentation (2), lacking (2), x64 (2), sbsa (2), blob (2), master (2), aarch64 (2), technical (2), non (2), after (2), vulnerabilities (2), half (2), gaps (2), gsoc (2), sharma (2), integration (2), paper (2), approach (2), where (2), analysis (2), variety (2), michael (2), end (2), mmurayama (2), indexdownload (2), asp (2), softwareguid (2), see (2), python (2), scripts (2), controller (2), via (2), redhat (2), cert (2), vuls (2), 174059 (2), embeddable (2), javascript (2), engine (2), build (2), defn (2), extension (2), like (2), files (2), certs (2), vulnerable (2), zmkfirmware (2), projects (2), keyboards (2), hope (2), into (2), boards (2), wifi (2), 00337 (2), 00355 (2), board (2), 00367 (2), drivers (2), 00369 (2), 00375 (2), nuc (2), 00376 (2), raid (2), driver (2), 00377 (2), 00378 (2), 00379 (2), 00384 (2), 00386 (2), 00387 (2), 00392 (2), 00394 (2), 00396 (2), 00399 (2), 00406 (2), 00411 (2), pfs (2), assembler (2), script (2), downgrade (2), able (2), file (2), utility (2), tables (2), anvilventures (2), defeating (2), attacks (2), anvil (2), technique (2), partition (2), labs (2), sentinelone (2), moving (2), sense (2), knowledge (2), actually (2), dumping (2), debug (2), fuzz (2), assaf_carlsbad (2), liba2k (2), mine (2), went (2), online (2), merely (2), next (2), will (2), innovative (2), discuss (2), techniques (2), feng (2), long (2), fuzzing (2), limited (2), independent (2), scalable (2), must, post, logged, loading, comments, collapse, bar, subscriptions, reader, report, privacy, already, account, now, join, 231, subscribers, another, world, desktop, phoenix, phoenix_technologies_bios, atom, xml, technet, aspx, mcafee, 160, 164, 137, 129, 143, 101, 103, 102, 110, 100, 168, 116, 105, 107, select, month, vincent, zimmer, forum, tianocore, spectre, smm, rust, qemu, nikolaj, schlej, meltdown, matthew, garrett, job, posting, sgx, amt, google, event, efi, ltd, ami, tags, linkedin, affiliate, links, guarantees, explicit, implied, careful, older, navigation, doc, document, nomenclature, describe, ways, manufacturers, internet, storing, sandelman, huawei, authors, well, when, had, bandwidth, read, rfcs, came, sigh, operational, manufacturer, installed, uses, libraries, library, attest, utilize, features, enable, critical, confidential, articles, they, such, bootguard, medium, yet, pretty, submit, email, contact, link, broken, encryption, exposed, network, services, mentions, vagueness, say, chrome, something, else, what, flavor, interacts, relatively, madrid, spain, daily, searches, potential, got, passed, regression, seeing, get, updated, firmwaretestsuite, infradead, pipermail, riscv, 001248, atish, western, digital, professors, please, suggest, grad, student, thanks, wonder, delta, wish, specific, make, tested, vice, versa, obviously, entries, others, users, know, isas, maybe, coverage, future, processors, eficheck, testcase, checklist, distinction, aarch32, intended, vendor, machines, consumer, prevent, leakage, strongly, recommended, platforms, production, scrubbed, running, x86, amd64, mac, own, handful, checking, tool, separate, checks, publicly, viewable, vendors, wondering, much, overlap, find, additional, checklists, overlaps, mail, hyperkitty, thread, pvafqqzkojxk26m44i7pegnbjmwouj5j, hello, everyone, harshit, hst, irc, add, feature, arxiv, abs, 2007, 09071, present, primitives, cryptographic, deployed, environments, communication, channels, insecure, implementation, flexible, adapted, regards, available, resources, constraints, resilient, attack, vectors, experimental, setup, demonstrates, feasibility, implementing, demonstrate, adaptability, performance, experiments, indicate, procedure, 1183kb, image, could, achieved, manner, under, seconds, solon, falas, charalambos, konstantinou, maria, modular, few, here, blogspot, 85dbc785, b759, 4cde, a1d3, c335b5ec7c1d, ced64cae, a20c, 494e, 91fe, 66adad0dbfd2, ansible, integrated, remote, management, primergy, beyond, ones, dozen, scripting, errata, rhsa, 3217, grub2bootloader, alerts, notices, usn, 4432, gnu, archive, devel, msg00034, eclypsium, theres, hole, case, reading, boothole, tuviannavy, released, nov, libc, shell, application, succeeded, confirmed, unkemptarc99, helps, points, definition, keywords, pcds, guids, etc, abhishek, musupport, vscode, edkii, really, provided, revoked, otherwise, bad, revocationlistfile, help, 4575994, applying, published, 200011, describes, related, party, unified, extensible, certificate, authority, configuration, susceptible, attacker, who, administrative, privileges, physical, apply, latest, revocation, invalidate, plans, push, further, 2021, knowledgebase, secureboot, offers, theregister, intel_nda_source_code_leak, del, dog, onufumerap, twitter, deletescape, status, 1291405690301550592, apparently, includes, fsp, lots, things, breach, internals, hoping, point, evolution, would, maker, badgelife, addition, focus, evolves, eventually, power, ecosystem, puts, effort, competing, arduino, believe, zephyros, supports, doesn, benroe, awesome, reddit, mechanicalkeyboards, tmk_keyboard, qmk_firmware, either, programmable, layers, macros, many, opportunites, badusb, let, learn, treat, powerful, appropriate, caution, zeyphyr, rtos, guess, main, alternatives, modern, bluetooth, iintel, proset, families, graphics, pac, arria, led, manager, rste, console, compute, m10jnp2sb, improvement, program, mailbox, realsense, d400, uwp, distribution, openvino, toolkit, ssd, dct, thunderbolt, advisories, vuquangtrong, original, modifies, jhand2, small, understands, format, print, them, human, readable, way, prints, releasing, white, describing, bypass, number, split, signed, protected, executables, protection, store, persistent, milvich, ventures, researchers, emulate, begin, ben, thurston, bthurstoncptech, 3vh3w74sym, assaf, carlsbad, nluu4r2lhm, sentinal, ris3, lab, usenix, conference, usenixsecurity20, presentation, _longlu_, interested, scale, due, dependencies, presenting, solution, 30p, welcome, tune, sniqlusyuz, usenixsecurity, bofeng17, dynamic, severely, dependence, poor, scalability, partly, contributing, widespread, propose, continuously, executes, binary, channeling, inputs, shelf, fuzzer, enabling, novel, abstracts, diverse, peripherals, handles, fly, automatically, generated, models, oblivious, designs, generic, implementations, therefore, applicable, wide, range, evaluated, drone, robot, plc, successfully, executed, without, manual, assistance, performed, unveiled, unique, unknown, bugs, alejandro, mera, northeastern, university, automatic, modeling, menu, skip,
Text of the page (random words):
ecurity center advisory intel sa 00399 html intel realsense d400 series uwp advisory intel sa 00396 https www intel com content www us en security center advisory intel sa 00396 html intel mailbox interface driver advisory intel sa 00394 https www intel com content www us en security center advisory intel sa 00394 html intel nuc firmware advisory intel sa 00392 https www intel com content www us en security center advisory intel sa 00392 html intel computing improvement program advisory intel sa 00387 https www intel com content www us en security center advisory intel sa 00387 html intel server board m10jnp2sb advisory intel sa 00386 https www intel com content www us en security center advisory intel sa 00386 html intel server boards server systems and compute modules advisory intel sa 00384 https www intel com content www us en security center advisory intel sa 00384 html intel wireless for open source advisory intel sa 00379 https www intel com content www us en security center advisory intel sa 00379 html intel raid web console 3 for windows advisory intel sa 00378 https www intel com content www us en security center advisory intel sa 00378 html intel rste software raid driver advisory intel sa 00377 https www intel com content www us en security center advisory intel sa 00377 html intel led manager for nuc advisory intel sa 00376 https www intel com content www us en security center advisory intel sa 00376 html intel pac with arria 10 gx fpga advisory intel sa 00375 https www intel com content www us en security center advisory intel sa 00375 html intel graphics drivers advisory intel sa 00369 https www intel com content www us en security center advisory intel sa 00369 html intel server board families advisory intel sa 00367 https www intel com content www us en security center advisory intel sa 00367 html iintel proset wireless wifi software advisory intel sa 00355 https www intel com content www us en security center advisory intel sa 00355 html intel wireless bluetooth advisory intel sa 00337 https www intel com content www us en security center advisory intel sa 00337 html zmk firmware modern open source keyboard firmware august 10 2020 hucktech leave a comment zmk is a new keyboard firmware software project it is based on zeyphyr rtos i guess the main keyboard firmware alternatives are qmk and tmk 1 https zmkfirmware dev as for security issues new mechanical keyboards with either qmk or tmk and i presume also with zmk are programmable with layers and macros with many opportunites to be a badusb device including wifi support not just usb let s hope that peripheral firmware and operating systems learn to treat these powerful peripheral devices with appropriate caution 1 https github com qmk qmk_firmware https github com tmk tmk_keyboard https www reddit com r mechanicalkeyboards wiki firmware https github com benroe awesome mechanical keyboard blob master docs firmware md ps i m hoping to see one of zmk tmk or qmk support risc v at this point in it s evolution risc v would be useful in more maker projects like mechanical keyboards and badgelife projects in addition to fpga centric focus while it evolves to eventually power a real pc i hope the risc v ecosystem puts more effort into competing with arduino and other arm dev boards while i believe zephyros supports risc v the zmk project doesn t https zmkfirmware dev docs hardware intel engineering data breach including firmware internals august 6 2020 hucktech leave a comment apparently the dump includes info on intel me intel fsp and lots of other things https twitter com deletescape status 1291405690301550592 s 20 https del dog onufumerap txt https www theregister com 2020 08 06 intel_nda_source_code_leak microsoft offers uefi secure boot dbx guidance august 6 2020 hucktech leave a comment microsoft has a new knowledgebase article on uefi secureboot dbx certs on july 29 2020 microsoft published security advisory 200011 that describes a new vulnerability that s related to secure boot devices that trust the microsoft third party unified extensible firmware interface uefi certificate authority ca in their secure boot configuration may be susceptible to an attacker who has administrative privileges or physical access to the device this article provides guidance to apply the latest secure boot dbx revocation list to invalidate the vulnerable modules microsoft plans to push an update to windows update to address this vulnerability after further testing in 2021 https support microsoft com en ph help 4575994 microsoft guidance for applying secure boot dbx update https uefi org revocationlistfile there really should be more technical information provided about the revoked otherwise bad certs in the dbx files uefi code defn a third uefi plugin for visual studio code august 4 2020 hucktech leave a comment re https firmwaresecurity com 2019 11 23 edk2 vscode visual studio code plugin for edkii files and https firmwaresecurity com 2019 10 01 musupport a vs code extension to support project mu there is a third uefi plugin for visual studio code from abhishek sharma of microsoft this is a vs code extension which helps points to definition of keywords in the uefi code like pcds guids etc https github com unkemptarc99 uefi code defn duktape uefi uefi port of the duktape embeddable javascript engine august 4 2020 hucktech leave a comment this is uefi port of the duktape embeddable javascript engine duktape 2 5 0 released on 24 nov 2019 it requires edk2 libc to build an uefi shell application build succeeded but not confirmed it works https github com tuviannavy duktape uefi https duktape org boothole grub uefi secure boot vulnerability august 4 2020 hucktech leave a comment in case you ve not been reading the news a vulnerability has been found in grub https eclypsium com 2020 07 29 theres a hole in the boot https lists gnu org archive html grub devel 2020 07 msg00034 html https www kb cert org vuls id 174059 https www kb cert org vuls id 174059 https ubuntu com security notices usn 4432 1 https cyber gc ca en alerts grub security advisory https access redhat com security vulnerabilities grub2bootloader https access redhat com errata rhsa 2020 3217 fujitsu redfish samples fujitsu irmc redfish scripting samples july 20 2020 hucktech leave a comment new python redfish samples beyond the ones in fujitsu s project half a dozen scripts including one that does a bios update sample python scripts to manage fujitsu integrated remote management controller irmc via redfish in fujitsu server primergy https github com mmurayama fujitsu redfish samples see also https github com fujitsu fujitsu ansible irmc integration https support ts fujitsu com indexdownload asp softwareguid ced64cae a20c 494e 91fe 66adad0dbfd2 https support ts fujitsu com indexdownload asp softwareguid 85dbc785 b759 4cde a1d3 c335b5ec7c1d there are a few blog posts on fujitsu redfish here http mmurayama blogspot com search q redfish a modular end to end framework for secure firmware updates on embedded systems july 20 2020 hucktech leave a comment by solon falas charalambos konstantinou maria k michael in this paper we present a framework for secure firmware updates on embedded systems the approach is based on hardware primitives and cryptographic modules and it can be deployed in environments where communication channels might be insecure the implementation of the framework is flexible as it can be adapted in regards to the iot device s available hardware resources and constraints our security analysis shows that our framework is resilient to a variety of attack vectors the experimental setup demonstrates the feasibility of the approach by implementing a variety of test cases on fpga we demonstrate the adaptability and performance of the framework experiments indicate that the update procedure for a 1183kb firmware image could be achieved in a secure manner under 1 73 seconds https arxiv org abs 2007 09071 coreboot address sanitizer integration with coreboot july 19 2020 hucktech leave a comment hello everyone my name is harshit sharma hst on irc i am working on the project to add the address sanitizer feature to coreboot as a part of gsoc 2020 gsoc address sanitizer part 1 https mail coreboot org hyperkitty list coreboot coreboot org thread pvafqqzkojxk26m44i7pegnbjmwouj5j intel arm microsoft apple platform security checklists overlaps and gaps july 19 2020 hucktech leave a comment so there are a handful of tools for checking for hardware firmware security issues each tool has a separate list of security checks half of which are publicly viewable with gaps from some hardware and os vendors i m wondering how much overlap there is between these security lists that might be useful to port and find additional security issues intel has chipsec for testing the hardware and firmware for security issues it works on intel x86 and intel x64 not amd amd64 it works on mac windows and linux and uefi public can run this on their own device https github com chipsec chipsec wiki vulnerabilities and chipsec modules arm has sbsa acs for testing hardware and firmware security issues it works on arm aarch64 enterprise devices unclear if there is a technical distinction for non enterprise aarch64 device use not aarch32 it works on uefi intended for vendor use on development machines not consumer devices to prevent the leakage of secure information it is strongly recommended that the acs test suite is run only on development platforms if it is run on production systems the system should be scrubbed after running the test suite https github com arm software sbsa acs blob master docs testcase checklist md apple has eficheck for macos it works on intel x64 and i am guessing that it ll also work on future arm processors the list of security tests it makes is unknnown the documentation is lacking microsoft has defender av which has uefi support for windows i presume but do not know it works on all isas that windows does so maybe coverage on intel amd and arm the list of security tests it makes is unknnown the documentation is lacking amd has nothing except for microsoft defender for windows users only linux has nothing except for intel chipsec on intel systems i wonder about the delta between these 4 security lists i wish there was more information from microsoft and apple on the specific tests their tools make are there any from one list that should also be tested on the other lists and vice versa obviously some entries are platform centric but there are others that might not be any professors out there please suggest a grad student do some research on the intel and arm security lists thanks fwts ported to risc v july 19 2020 hucktech leave a comment re https firmwaresecurity com 2016 05 08 uefi ported to risc v atish of western digital is using fwts to test the risc v port of uefi on linux http lists infradead org pipermail linux riscv 2020 july 001248 html https wiki ubuntu com firmwaretestsuite colin of canonical has updated fwts to have a risc v port day off work today seeing if i can get fwts to work on risc v colin ian king colinianking fosstodon org colinianking july 17 2020 got the firmware test suite ported and passed all the regression tests on risc v o colin ian king colinianking fosstodon org colinianking july 18 2020 potential verified boot support in barbara iot new os july 19 2020 july 19 2020 hucktech leave a comment there is a relatively new operating system called barbara iot based out of madrid spain which is new to my daily verified boot searches their security page mentions verified boot given the vagueness of their web site i can t say if this is linux android chrome verified boot or something else unclear what flavor s of platform firmware the os interacts with raise the security level of your devices with verified boot data encryption and no exposed network services have not found the source to the os yet i m guessing closed source their web site is pretty closed it requires you to submit name email contact info to view any data on their os their home page link to their developers page is broken https barbaraiot com https barbaraiot com security view at medium com raise the security level of your devices with verified boot ibm policy based governance in a trusted container platform july 17 2020 hucktech leave a comment ibm has a new article discussing how they secure their cloud discussing security technologies such as tpm intel txt and intel bootguard https developer ibm com articles policy based governance in trusted container platform project uses intel security libraries for data center intel secl dc a library that discover attest and utilize intel security features to enable critical cloud security and confidential computing use cases https 01 org intel secl ietf draft richardson secdispatch idevid considerations 01 security and operational considerations for manufacturer installed keys and anchors july 16 2020 hucktech leave a comment there was a time when i had bandwidth to read all new ietf rfcs and i ds that came out each day sigh there is a new ietf internet draft from the anima working group about storing private keys in embedded devices sandelman software works and huawei technologies are authors there are other documents from this working group as well this document provides a nomenclature to describe ways in which manufacturers secure private keys and public trust anchors in devices https datatracker ietf org doc draft richardson secdispatch idevid considerations https datatracker ietf org wg anima about https datatracker ietf org wg anima documents https tools ietf org wg anima posts navigation older posts disclaimers no guarantees explicit or implied be careful working with firmware affiliate links in use sponsored by preos security follow us x x x rss feed rss feed linkedin github search search for tags acpi amd ami android apple arm arm ltd bios canonical chipsec coreboot debian edk2 efi event freebsd fwts google hp ibm intel intel amt intel me intel sgx iot job posting lenovo linaro linux macos matthew garrett meltdown microsoft nikolaj schlej qemu redfish red hat risc v rust secure boot smm spectre tianocore tpm u boot uefi uefi forum usb vincent zimmer windows archives archives select month august 2020 12 july 2020 29 june 2020 45 may 2020 50 april 2020 32 march 2020 22 february 2020 30 january 2020 20 december 2019 30 november 2019 30 october 2019 38 september 2019 22 august 2019 56 july 2019 54 june 2019 31 may 2019 64 april 2019 73 march 2019 83 february 2019 66 january 2019 88 december 2018 77 november 2018 95 october 2018 107 september 2018 54 august 2018 105 july 2018 116 june 2018 168 may 2018 112 april 2018 112 march 2018 90 february 2018 100 january 2018 110 december 2017 102 november 2017 93 october 2017 87 september 2017 75 august 2017 103 july 2017 87 june 2017 94 may 2017 95 april 2017 101 march 2017 85 february 2017 90 january 2017 83 december 2016 45 november 2016 33 october ...
|
