UEFI malware bypasses all security and cannot be removed!

Once upon a time in the PC world there was BIOS. You used it to configure various aspects of your hardware, things like setting the date, resetting the amount of memory or sometimes testing it, overclocking your CPU if that was your thing. It evolved for a number of years until it was decreed to not be safe enough, and UEFI was introduced. It was supposed to be the ultimate in software security, and unhackable.

(another thing about UEFI was it made life hell for a long time to install Linux on personal equipment)

BWAHAHAHAHAHA!

Well, UEFI has been hacked.

A real-world exploit has been found, and it's not easy to implement. But if it gets into your system, it has been rooted. Someone can do anything they want on your system. Even replacing your hard drive, normally the ultimate last-ditch 'get rid of malware' strategy doesn't work - the software is actually inside your PC motherboard! And you pretty much cannot change UEFI chips, so your only solution is to replace the motherboard, or replace the entire computer!

FORTUNATELY, for some small value of fortunately, this is a very advanced exploit and tough to get into place - but it can be done. Because of the work that goes into inserting it into your system, it's highly unlikely that crooks are going to waste their efforts trying to get it into John/Jane Doe's systems. They'll spend their resources on getting it in to high value systems where they will get a gain out of it, through blackmail or theft.

https://arstechnica.com/information-technology/2023/03/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw/

https://it.slashdot.org/story/23/03/06/1854200/unkillable-uefi-malware-bypassing-secure-boot-enabled-by-unpatchable-windows-flaw

The literary executor of Usula K. Le Guin is allowing changes to her YA/youth books

In this case, her executor is her son, so he does have firsthand knowledge of some of her thinking.

It's an interesting essay on a very tough issue, with good points and bad points - IMO. We've seen Road Dahl's publisher back off on updating his books and they've split their printing stream, still issuing original books under a different imprint. Ian Fleming's James Bond books are being revised to remove offensive language.

I find the second and third paragraphs before the end to be quite good and worth contemplation.

https://lithub.com/why-i-decided-to-update-the-language-in-ursula-k-le-guins-childrens-books/

Two Teslas, much alike in appearance, drivers get into the wrong car and drive away!

This is amazing. Tesla has wireless entry through their smartphone app, or you can wave a bar code under a scanner built in to the driver's mirror. They might also have a fob, I'm not sure. Anyway, Driver A walks up to Car B, it unlocks and starts for him. And he drives off. Then he notices a huge crack in the windshield and his phone charging cable isn't there!

Driver B walks up to Car A, it unlocks and lets him start it. He drives off, notices the crack in his windshield isn't there and there's other stuff in his car that he didn't recognize!

Fortunately Driver B found a piece of paper with A's name and phone number, called him, and eventually they got together, exchanged cars, and had a laugh and lots of puzzlement. They contacted the police who said 'no harm, no foul' and to go away.

But guess what. Now that this flaw is known, every criminal hacker is going to be probing for how to exploit it. And they will succeed.

The ridiculous thing about this is that it was so easily preventable. Presumably Tesla has some sort of an encrypted key exchange going on to try to prevent it, and clearly failed. All they had to do was add the VIN to their secret key and you'd be largely guaranteed that only people whom you wanted to have access to your car would be able to unlock it and drive it.

I sent this article to a friend who had one of the first generation Tesla Roadsters, back before the Muskbrat turfed the inventors. He sold it after I told him about a serious flaw that was threatening all Teslas, which would cost him probably $4,000 or more to remedy. He bought a maxxed-out Toyota Avalon Hybrid, which he absolutely loves. It has a very interesting security feature: lock the door with a key, and the wireless remote won't work!

https://www.nbcnews.com/news/us-news/canadian-motorist-unknowingly-opens-wrong-tesla-allowed-drive-away-rcna74872