Newsletter Archives

  • Is firmware patching important?


    Susan Bradley

    By Susan Bradley

    Firmware patching has always been fraught with concern.

    Until very recently, applying firmware updates often meant launching the update process from a DOS prompt. You often received warnings that if your computer lost power during the process, your machine might be bricked. This is such a daunting thought that, for servers, I would often update the firmware when I initially installed the server and never touch it again.

    But firmware is nothing more than software, and — like every other kind of software these days — attackers find vulnerabilities in firmware. Recently, researchers found security issues in Lenovo consumer notebook firmware.

    Read the full story in our Plus Newsletter (19.19.0, 2022-05-09).

  • Microsoft promises firmware patches for Surface devices to nullify Meltdown and Spectre

    There’s a new post out from the Surface team: Surface Guidance for Customers and Partners: Protect your devices against the recent chip-related security vulnerability. It says:

    Microsoft will provide UEFI updates for the following devices:

    Surface Pro 3
    Surface Pro 4
    Surface Book
    Surface Studio
    Surface Pro Model 1796
    Surface Laptop
    Surface Pro with LTE Advanced
    Surface Book 2

    The updates will be available for the above devices running Windows 10 Creators Update (OS version 15063) and Windows 10 Fall Creators Update (OS version 16299). You will be able to receive these updates through Windows Update or by visiting the Microsoft Download Center.

    Apparently if you aren’t running Win10 1703 or 1709, you’re out of luck.

    Annoyingly, the post speaks in the future tense. I don’t see any notice of availability on the official release pages for those devices. (See, for example, the Surface Pro 2017 page, which lists the last firmware/driver update as Dec. 6.) I also don’t see any of the patches in the Update Catalog.