Introducing the Linux Vendor Firmware Service

Richard Hughes Principal Software Engineer, Red Hat [email protected] The Introduction Story

● What hardware? ● What updates? ● Where from? ● How to apply? The Introduction Story : ColorHug The Introduction Story : BIOS Easiest way to infect hardware?

Missing protections Failed root-of-trust Implanted updates Unsigned updater Malicious devices ??? The Grand Design™

● fwupd – 100% free software (LGPLv2+) – Mechanism – Used by users, typically with a GUI ● lvfs-website – 100% free software (GPLv2+) – Data source – Used by vendors: OEMs and ODMs

The Grand Design™ : Architecture

The Grand Design™ : GNOME Software

Layers of Security

LVFS : It’s just a website...

Bi-directional Feedback : User Reports

Bi-directional Feedback : Auto Demotion

Bi-directional Feedback : Signed Reports

Privacy Concerns : Trust Me

● Mirror the LVFS using PULP ● Vendor secrecy

Vendor Relationships : User Permissions

Firmware Analysis

Firmware Analysis : Comparing Shards

Firmware Analysis : UpdateCapsule

Firmware Analysis : Certificates

Firmware Analysis : Raising the Bar

Firmware Analysis : Device Lifecycle

Vendor Relationships : Complicated

● OBV → ODM → OEM → User ● “Trade secret” update protocols

Attestation and Dashboards

World Domination : Green Ticks

● Increasing requirement for “3 LVFS ticks” – Dell, Lenovo, Google, Red Hat, various UK and US governmental departments ● Change in tone

World Domination : Vendor Support

User Search Results

Looking to the Future

● Dashboard, albeit with caveats ● The few remaining vendors, ASUS, Microsoft, etc. ● More tests, possibly using external companies

Thank you!

● Question Everything! – (except asking what vendors are testing in secret!) – https://www.fwupd.org/ – https://github.com/fwupd/lvfs-website