Eclypsium Blog

Title is highly misleading. Outright dishonest. Their argument is essentially: If you can remove and repogram a network connected micro-controller (specifically the BMC) you can introduce a backdoor. Which is both obvious, and has absolutely nothing to do with Bloomberg's claims. I'd strongly recommend the mods change both the link and title to the original eclypsium source: "The Missing Security Primer for Bare Metal Cloud Services" https://eclypsium.com/2019/01/26/the-missing-security-primer-for-bare-…

Probabilistic Arm MTE memory safety is a stepping stone to deterministic CHERI hardware, https://saaramar.github.io/memory_safety_blogpost_2022/ & https://news.ycombinator.com/item?id=39668053 The right kind of mitigations targets the 1st order primitive; the root cause of the bug. Hardware solutions: CHERI (Morello, CheriIoT), MTE Software mitigations: kalloc_type+dataPAC, AUTOSLAB, Firebloom, GuardedMemcpy, CastGuard, attack surface reduction Safe programming languages: Rust, Swift MTE/CHERI play pretty nicely - they help ensure that whatever bugs we have in these areas are killed at their root cause… MSR, MSRC and Azure Silicon pushed for… scaling CHERI down to RISC-V32E, the smallest core RISC-V specification. Microsoft Research open-sourced a hardware/software stack for CHERI in IoT devices, https://msrc.microsoft.com/blog/2023/02/first-steps-in-cheriot-securit… CHERI-based microcontroller that aims to… get very strong security guarantees if we are willing to co-design the instruction set architecture (ISA), the application binary interface (ABI), isolation model, and the core parts of the software stack… our microcontroller achieves the following security properties: Deterministic mitigation for spatial safety (using CHERI-ISA capabilities). Deterministic mitigation for heap and cross-compartment stack temporal safety (using a load barrier, zeroing, revocation, and a one-bit information flow control scheme). Fine-grained…

Original reporting yesterday: https://news.ycombinator.com/item?id=45584343 https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-pla… BTW, from all I can tell this should actually be affecting all/most other x86 laptop vendors and nothing really unique to Framework here? This targeted security reporting curiously coincides with a supposedly unrelated recent and ongoing political PR campaign against Framework...

Eclypsium | Portland (US), Córdoba (ARGENTINA), Singapore (remote) | ONSITE / HYBRID / REMOTE | Full-time & Contract https://eclypsium.com/company/careers/ We protect devices from chip to cloud—securing firmware, hardware, and the supply chain beneath the OS. Fortune 100s and federal agencies run us in production. - Senior Software Engineer – Portland, OR - Platform Architect – Córdoba, AR - Sr. Software Engineer (Data) – Córdoba, AR - Junior Data Engineer – Córdoba, AR (new) - R&D Consulting Engineer – Singapore (remote OK) Why Eclypsium: - Startup speed, no politics, real impact - Equity, full health, flex PTO, parental leave I’m Rob ([email protected]). Eclypsium found me via HN. If a role fits, please apply at the link, and feel free to reach out with questions.

https://eclypsium.com/blog/understanding-detecting-pixiefail-uefi-vuln… https://binarly.io/posts/The_Far_Reaching_Consequences_of_LogoFAIL/

List of affected models: https://eclypsium.com/wp-content/uploads/Gigabyte-Affected-Models.pdf

From the blog post referenced [0]: > Eclypsium automated heuristics detected firmware on Gigabyte systems that drops an executable Windows binary that is executed during the Windows startup process. ...Windows startup process allows for executing "dropped binaries"? Would this be via replacing legit startup binary, or another vector? [0] https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-…

So apparently Grub inputs are security critical because it's been blessed to be a part of the TCB of secure boot systems. Previously: https://eclypsium.com/2021/04/14/boothole-how-it-started-how-its-going…

"ECLYPSIUM Discovers Multiple Vulnerabilities Affecting 129 Dell Models" https://eclypsium.com/wp-content/uploads/2021/06/Eclypsium-Discovers-M… "DSA-2021-106: Dell Client Platform Security Update for Multiple Vulnerabilities in the BIOSConnect and HTTPS Boot features as part of the Dell Client BIOS" https://www.dell.com/support/kbdoc/nl-nl/000188682/dsa-2021-106-dell-c…

[1] https://eclypsium.com/2020/07/29/theres-a-hole-in-the-boot/ The mighty GNU moos MÄGYCK! Now hurry, put your seven-league boots on :-)

Blogspam of https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-s… (and submitter does nothing but spam links to secalerts.co)

Full post from eclypsium https://eclypsium.com/2019/01/26/the-missing-security-primer-for-bare-… Also I assume aws baremetal servers are not vulnerable due to the nitro security card (https://m.youtube.com/watch?feature=youtu.be&v=e8DVmwj3OEs&t=1…