… The issue affects users who disabled automatic software updates, remained on an older software version for an extended period, and then manually installed a firmware update after the update package had been stored on the Bridge for more than 10 days. …
… If at all possible, users should hold off on installing new motherboard firmware updates until after the new certificates are replaced. …
… But previously approved routers were hit with a separate rule that would prohibit software and firmware updates—unless the FCC keeps extending the cutoff date after which no updates can be installed. …
… In response, Airoha released an updated software development kit to affected hardware sellers. …
… Also surprising: One of the CTP commands, labeled “upload new firmware to device,” allowed him to replace the official firmware with his own custom one. The firmware reflashing didn’t use code signing or other measures to prevent the loading of unofficial code. …
… From there, an attacker can subvert the mandated chain of digitally signed firmware to install malicious firmware that loads early in the boot process and persists after either the OS is reinstalled or a hard drive is replaced. “What makes these old shims dangerous is not a novel vulnerability,” ES… …
… The use of secrets recoverable from firmware as live credentials. Keys and constants that can be extracted from public firmware can be used to authenticate to, or decrypt traffic from, BMCs. …
… The move came solely as a result of firmware changes made in a recent update. With no physical changes required to silicon, continued support was largely, if not purely, a matter of will rather than a necessity required by changes to hardware. …
… She's been reporting on technology for over 10 years, with bylines at Tom’s Hardware, Channelnomics, and CRN UK.
… She's been reporting on technology for over 10 years, with bylines at Tom’s Hardware, Channelnomics, and CRN UK.