Could Someone attack tails firmware through tails?

Question

Could Someone attack tails firmware through tails?

I have noticed that some applications on OS does not require administrative privilege. Such is the browser add-on such as the one that can be used now to download tails. So will it be better if we broaden the administrative privilege granting requirements to include more security for the OS. If someone send a payload to the tails OS which will it or will not result in that payload flashing my firmware. Most such payloads may some may not or they contain a flash utility. Would tails prevent such utilities from working without administrative privilege set?

If not is it possible for tails to broaden the administrative privileges to include such utilities from functioning with administrative privilege set and not without super user rights set Or just remove this function or code all together?

In the case of UEFI there may or may not be an added method of reaching the firmware. Most prior Linux kernels did not support firmware updates. Now there have been improvement in the kernel to include UEFI updates. Most new kernels and some old ones still as well support firmware updates. Does tails remove the code that courses such updates?

If not is the case would it not provide more security for the OS if such function code be removed from the tails OS?

Answer 1

Yes, someone could attack firmware from Tails.

No, broadening the administrative privilege requirements won't help.

Tails does require administrative privileges to perform most of these activities, however these privileges are granted automatically to a subset of processes with limited scope. This reduces the attack surface for performing such attacks.

Conversely, requiring root privileges to perform day-to-day activities, like installing updates only exposes unlimited privilege escalation to any successful attacker, which they wouldn't otherwise possess. Once the user, from userspace, escalates to root (through sudo or the root terminal) any other process running in the context users account can hijack the users elevated privilege state to perform unconstrained attacks.

So:

• Yes, it is possible.
• No, it is not likely.
• Making the user accept more privileges more often will make you more vulnerable to that kind of attack.