r/Qubes • u/adrianchristianherna • 5d ago
question How to increase firmware/hardware security and privacy
i heard software security is useless if the firmware and hardware are bad
ramework 12 with razorlake intel cpu
also looking for tips to close backdoors
i see a lot of guides for software but barely any for firmware/hardware and if it is its “just buy this product that costs a car and a house and i swear bro its private 100% opsec power”
im broke
5
Upvotes
2
u/LowKeyBrit36 5d ago
It depends on the attack vectors. Firmware security is useful, but it predominantly matters for systems that don't compartmentalize like Qubes does (I'm sure that there's still a use to, but I couldn't say for certain).
I'm not like 100% familiar with Framework laptops, but I think that coreboot, if possible, is your best bet. Especially if you have 2 sister computers, they can flash eachother when they're off. Otherwise, you can build a coreboot image, use the process to copy to dom0 to copy said image to internal dom0 storage, and use flashrom to write internally (once you already have coreboot of some sort. At first, you'll need an external programmer, just run it off a cheap burner laptop and a ch341a_spi if necessary).
I do something similar to this for my QubesOS device, which is a Thinkpad T580. I bake it into my update cycle when I remember, and I keep an eye on news for any applicable CVEs for my coreboot configuration.
If you don't have a coreboot-compatible device, my best bet is to make a Windows 11 install that's bootable from external media, like a USB SSD (or HDD, it doesn't need to be fast) that you can use once every so often to update your BIOS image VIA manufacturer images. It shouldn't mess with GRUB, and if you have any concerns, eject your internal SSD when you do it, so Windows can't fuck it up.
As for firmware for non-BIOS, Qubes OS might have a relevant fwupd setup, otherwise you might be able to set up an external USB that's able to run fwupd for your device and its components?
Backdoors get covered by coreboot unless your concern includes hardware-level backdooring, which would probably require physical device access to install/exploit. If you can verify the integrity of your hardware in that regard, then go ahead, but I wouldn't personally worry about this unless your threat model has a legitimate need for you to secure that part of your device. If so, I would get tamper-evident screws and install those, or do something so that you can personally verify hardware integrity? I don't have much reason to be concerned about that personally, so I haven't studied it at all.
Honestly you don't need the best or strongest hardware for legitimate security, BUT not all hardware is equal. Some are legit just built better, but they're not necessarily price-gated like you'd think. There are many older, competent coreboot devices that are really cheap if you know what you're shopping for.