A Secure 2B1 BIOS Update Method

   
   
   
   
   

BIOS screen

The One Laptop Per Child 2B1 computers, like all PC computers, will have a BIOS to control basic computer functions. And as security patches, bug fixes, and future enhancements are made, the 2B1 BIOS will need to be updated.

OLPC is currently thinking through the process of making a BIOS upgrade that with be safe against hackers and their worm spawn, but at the same time will allow for upgrades by OLPC or even national governments.

The software developers agree they need hardware-level protection, or else worms could destroy any laptop they reached, thousands simultaneously if they were mesh-Internet connected. The prevailing idea was to require a set of physical keys to be pressed to authorize an upgrade (Ctrl+Alt+Del for example), which could still be compromised by phishing ("Hey kid, press Key 1+2+3 to download this game!").


OLPC BIOS chip

Then at an unpleasant hour of Sunday morning, Ivan Krstić, a developer on the OLPC team had an inspiration and detailed a rather technical approach to upgrading BIOS that promised to be:

a completely secure BIOS solution which requires no TPM, allows fully automatic upgrades without the user's cooperation (such as pressing keys), and fully protects both against phishing and automated attacks -- in fact, it's vector-independent. The design also allows provisions to be made for kids that are brave enough to want to hack their BIOSes, as well as for countries which want to offer additional non-OLPC BIOSes.
Ivan ended his post with a very brave call for critiques, and like DoS attack, they came fast and furious, but mostly on policy instead of the technical approach.

First up, other developers questioned the idea of automatic upgrades executed without a user's consent with commentary from the basic belief that updating a new BIOS without user knowledge is *evil* to the more detailed and persuasive:

Upgrading of firmware should always require the users explicit assent… It's too dangerous to allow automatic upgrades of the firmware, cryptographically signed or not. Do you know of any devices that upgrade their firmware without consent unless the *local* admin has explicitly chosen to enable that? I'd guess they are few and far between. If anything, maybe cable boxes and DVRs. OLPCs are not TVs.
Yet, not everyone thought it was *evil* to do automatic upgrades. Some felt that requiring student's cooperation for legitimate upgrades would burden them with the need to distinguish between legitimate and illegitimate upgrades, or require adult supervision, both which could still be fooled by phishing.

Personally, I tend to believe that there can be no technical solutions to phishing, it's a problem of educating the user. Or for those who still believe PayPall email, a way to cull out the fools.

Still, Ivan new approach allows the next generation of hackers to experiment with BIOS, maybe producing a new Linus Torvalds by asking for a developer signing key. That is unless a worm author doesn't fool OLPC with "Hey, I'm a kid wanting to hack the BIOS, can I have a signing key?"

And of course there is always the ever present soldering iron, which can swap out any BIOS-containing internal component or, once quantum computing becomes reality, pure raw power encryption-cracking. Neither is part of the threat model, but Ivan successfully defended his idea against them none the less.

No matter the outcome, the process, by being open to public scrutiny and even asking for it, will produce a bios update far more secure than the current "security through obscurity" mindset. Or as Ronald Minnich says:

Score one more for open sources BIOSes!
.

Related Entries

1 Comment

The developer signing keys are locked to a particular machine; a worm author who impersonates a child would be able to write a payload that maliciously replaces exactly one laptop's BIOS.

By the way, the chip image is not of our actual SPI ROM, but of a PLCC that's there for testing and development purposes.

XO Tablets for Sale

Buy Your XO Tablet on Amazon.com
OLPC is selling the new XO Tablets on Amazon.com for just $149. Buy yours today!

xo-tablet-amazon.jpg

Discussions


    Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Oh, come on Michael. Do you really think anything that was said on OLPC News would have had much …

    Comment on Goodbye One Laptop per Child

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Hi!

    I bought 2 "Tablets OLPC." I had to return because the two did not work. O …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Dear sir
    I have one question to sir?

    -1 why XO Tablet children play OK but when h …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Dear sir
    I have one question to sir?

    -1 why XO Tablet children play OK but when h …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Dear sir
    I have one question to sir?

    -1 why XO Tablet children play OK but when h …

    Comment on Guest Post: My XO Tablet Technical Review and First Impressions

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Bonjour Mokifisi!
    Je suis bien d'accord avec vous. Je travaille depuis 4 ans dans un petit …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • You just follow the same route upstream how you got the 2XO Tablets? How did you get them? Bring …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • quelle adresse envoyer mes deux XOTablet qui ne fonctionnent pas?

    At what address to s …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • That's called "Death on arrivals". They happen. That's why there's always some additio …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • What is a shelf XO? If you tell me what did you buy and from whom, perhaps I will have a suggest …

    Comment on Goodbye One Laptop per Child

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • Voici mon message en franais...

    Bonjour,
    Je viens d'acheter 2 tablettes XO. Les d …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • I just bought 2 shelves XO. Both tablets are not working. One does not start and the other touch …

    Comment on The XO Tablet - A First Impression in 750 Words

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • I just bought 2 shelves XO. Both tablets are not working. One does not start and the other touch …

    Comment on Goodbye One Laptop per Child

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • I just bought 2 shelves XO. Both tablets are not working. One does not start and the other touch …

    Comment on Goodbye One Laptop per Child

  • Warning: Use of undefined constant title - assumed 'title' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1473

    Warning: Use of undefined constant link - assumed 'link' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1474

    Warning: Use of undefined constant description - assumed 'description' (this will throw an Error in a future version of PHP) in /nfs/c03/h03/mnt/54379/domains/olpcnews.com/html/includes_c/sidebar.html on line 1475
  • OLPC is not death; eg. this One Laptop per Child San Francisco (OLPC-SF) June 21, 2014 Meeting a …

    Comment on Goodbye One Laptop per Child

Recent Comments

Community Forum

Close