Thanks @nrp for chiming in! As a security professional (CISSP and CCSP), I was curious to see what Framework and Insyde’s response would be to this. Pumped to see Insyde and Framework are on top of it.
4 Likes
Interested read from Ars Technica
UEFIs booting Windows and Linux devices can be hacked by malicious logo images.
LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux. The vulnerabilities are the product of almost a year’s worth of work by Binarly, a firm that helps customers identify and secure vulnerable firmware
the company Binarly is currently working with Framework on their firmwares
1 Like
Yep, I also want to know if a changed image would result in a different TPM2 state and which PCR would differ.
1 Like
I guess this attack would also be an attack vector for loading a logo that could compromise a machine.
That’s why you shouldn’t enable passwordless sudo.
ESP requires elevated privileges to write to, so you are protected in this case if keystroke injection can’t elevate privileges without authentication (assuming attacker doesn’t know your password)
Based on analysis from Binarly, we believe each of our currently launched platforms except Chromebook Edition is vulnerable to some form of LogoFAIL. We are working with our upstream UEFI supplier, Insyde, in order to get the necessary update from them to resolve this. This is occurring as part of our sustaining software initiative.
56 Likes
Thank you for the quick answer and openness. Other companies might be temped to delay saying that.
Everyone should remember that due to there being far fewer Framework Laptops out in the wild vs models from big brands, we should be pretty far down on a target list.
3 Likes
This is great to hear. Thanks @nrp. It will be a really good example to show how FW has strengthened the BIOS maintenance approach.
4 Likes
Figured as much. Thanks for acknowledging. My research with Recorded Future’s threat intel platform suggests this is already beginning to be exploited in the wild with bad logos being implemented. Glad to see Framework and Insyde are on it and keeping our computers safe.
2 Likes
@nrp Can you please provide some insights here? I guess the original logo is measured into PCR0, so this could detect an attack (since the framework logo is not protected by intel boot guard). Would a changed image via the ESP change e.g. PCR1?
1 Like
@nrp: Is there a way to skip the image parsing process? Let’s say I press F2 at boot to enter the BIOS, is a custom logo not parsed? If so, if I then continue to boot, do I skip an attack?
Especially if it will take longer to release BIOS updates, please investigate some possible “mitigations”.
1 Like
The only time anyone has ever preferred having a Chromebook 
10 Likes
coreboot is one of the things why Id like a chromebook. if only I could have bought one. (europe, none availeble when I ordered my 12th gen)
1 Like
Hello,
As you may know, a vulnerability in the UEFI of x86 and ARM processors has been found. Since this affects the UEFI, it can infect both Linux and Windows.
I assume Framework will issue a UEFI update to address the issue. Until now, be careful.
2 Likes
There is already a thread here about this subject, into which FW have replied with details of what is happening about it.
2 Likes
It may make sense to pin this thread for a bit to avoid someone starting a new one every couple minutes.
8 Likes
Looks like it’s supported by mrchromebox alternative coreboot firmware too according to the Chrultrabook device support table
1 Like
The chromebook version of Framework’s laptop is, Framework | Choose Framework Laptop Chromebook Edition (12th Gen (if this page doesnt work, try set your region to US. exactly exposing my issue, I cannot order a Chromebook edition in europe)
The hardware is confirmed to be different in such a way, doubt its firmware will be able to be flashed and functional on a non-chromebook 12th gen FW13
Most Chromebooks would likely be built this way. It’s part of the spec Google requires for a device to be considered a Chromebook. While the Framework Chromebooks are out of stock, so I’m unable to help test alternative Coreboot firmware, my Lenovo C13 Yoga is successfully running openSUSE Tumbleweed under custom firmware currently so that’s fun.
1 Like
I’d just love to change the logo 
2 Likes