Another successful OpenBSD setup
I’ve been buying these little boxes from AliExpress for years to use as firewalls and routers. My oldest one is almost 9 years old now! OpenBSD installs just fine. Just a BIOS tweak to always boot up after power is restored.
Do any of those cheap Chinese computers ever get any firmware or bios updates?
No and they don’t provide the source either. Makes you wonder what’s running in there.
While i agree, no one provides full source blobs for firmware and bios that i am aware of. Please correct me if I am wrong, however.
https://github.com/StarLabsLtd/coreboot
https://support.system76.com/articles/open-firmware-systems/
https://novacustom.com/coreboot-laptop/#get-yours-now
https://www.tuxedocomputers.com/en/Infos/Help-Support/Frequently-asked-questions/Coreboot-on-TUXEDO-Computers-devices.tuxedo
Open source bios yes, but you still have close source firmware blobs for amd/intel used on those systems. The only way to do this is to make 100% of the hardware.
Also please note, I am using coreboot already on my pcengines router.
Few computers use CoreBoot, and CoreBoot still uses proprietary blobs typically. Normally only libreboot has zero blobs, and they are very rare indeed.
I’d be surprised if it wasn’t just based off the UEFI sdk examples containing 30+ CVEs over the last couple of years. If anything, it won’t get patched for logofail and all the others UEFI exploits we’ll definitely see in the coming years.
None that I know of :(
But @benjja tells me that on some of these you can install coreboot: https://ohnepunktundkomma.org/@benjja/111991771619601081
Something I’m keen to look into.
@cmnybo @selfhosted
@otl @cmnybo @selfhosted
Protectli ported coreboot for their hardware, and with a little research you can find this hardware on aliexpress, of course under a different name.
I was wondering… that tp-link probably negates anything remotely resembling security on its own. But yeah, you can update some of these noname boxes easily, others, not so much.
I have dealt with (in a professional capacity) Chinese manufacturers that are under the impression they do not have to provide a working build tree for the kernel, let alone firmware, so its a gamble if you’re not talking to a major Chinese name brand. Mind you, I was ordering hundreds of those boxes, so there was some leverage.
That TP-link is a dumb switch. Unless you’re telling me that someone is going to find an opening in the firmware and hack their way into the ARP table or something (in which case the threat model here just became state actors and I don’t think the OP is safe with this equipment), I don’t think it affects much, if anything.
Now, if I’m mistaken and that is actually a managed switch; god help them with network security.
It is a managed switch. What’s wrong with TP-Link managed switches?
I have a basic Netgear managed switch for VLANs.
The problem is that their Web interface and firmware in general are not updated (at all). I think it’s even possible for script kiddies to hack into such managed switches, which forms the reasoning behind my comment.
Does your switch produce its Web interface over TLS?
Doesn’t look like it but if I set up VLANs unless an user is on the correct VLAN they can’t access the web interface. And the only way for them to get access is to get physical access and plug a device into the correct port.
VLAN hopping can be done on outdated firmware if one is somewhat determined, AFAIK
From the switch? I thought the routing was done at the router level?
If the switch is managed (I’m assuming it supports L3 functions which means inter-VLAN routing), then it’s possible to hop VLANs on the switch.
They do make managed switches, but just to be completely clear, my comment was mostly hyperbole. I just found the general combination of security - mindedness and cheap Chinese hardware curious / amusing.
I did realise that, and apologies for my tone earlier.
With that said, this seems to be a slight bias - unless the PCB has some nefarious spy-chip built inside, hardware is hardware, regardless of where it comes from.
I think it can make sense, since there are so often vulnerabilities in consumer router firmware, and because those devices are so common the vulnerabilities are profitable to exploit. Running a BSD-based router on a cheap Chinese PC is likely to be better security for the router’s OS and software itself, even if you don’t know for sure about the firmware on the board (which you don’t with consumer routers either, really). Overall you could still have reduced your attack surface compared to a popular consumer router.
Does any board ever get firmware updates? I don’t understand your logic.