Slashdot Mirror
Rootkits Head for Your BIOS
Artem Tashkinov wrote to mention a SecurityFocus article which discusses a disturbing new threat to computer security: Rootkits that target a computer's BIOS. From the article: "One rootkit expert at the conference predicted that the technology will become a fundamental part of rootkits in the near future. 'It is going to be about one month before malware comes out to take advantage of this,' said Greg Hoglund, a rootkit expert and CEO of reverse engineering firm HBGary. 'This is so easy to do. You have widely available tools, free compilers for the ACPI language, and high-level languages to write the code in.'" Update: 01/27 14:28 GMT by Z : John Heasman wrote with a link to the slide presentation on this topic given at the Black Hat Conference (pdf).
What about EFI?
"Things are more moderner than before- bigger, and yet smaller- it's computers-- San Dimas High School football RULES!"
it worked for floppy disk.. I want a little hardware switch that cuts the write lines @ the bios
The problem is, think of Joe Sixpack updating his own...
Wait. Never mind. Joe Sixpack almost would never flashes a BIOS, because he still calls the tower "my hard drive."
There are two contradicting principles here.
Many home users want that second kind of functionality. Partly because they don't want to bother with the details, partly because they are mentally challenged. They really like to be able to update the Computer's BIOS as easy as visiting a web site or running any kind of program. Unfortunately, this is what they get. And so do we.
No, on the inside would stop it from being tripped by accident, or by users who have no idea what it does and decide to start playing with it. Also, all updates to the BIOS should just be stored on a secondary chip, and have to be confirmed when the user boots up the next time before it is copied to the actual bios. And there should be a third read only chip containing the original bios, which could somehow be loaded in the case of an emergency/mistake. BIOS chips can't really be that expensive, so putting extra security measures in place to not get your system hosed are important.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Way way back in the summer of 1994 we use to have viruses that would write themselves to the boot sector of our hard drives and some of them would even overwrite our Bios. I wouldn't expect you to know about it, since it happened so long ago but, those were tough times. Some PC manufacturers would even put antivirus detection software in their Bios to detect and prevent these Bios viruses. Sometimes it worked. Other times your system was hosed!
Grandad Admin.
In all seriousness, I am surprised at the lack of malicious viruses today. In yesteryears, viruses wiped out data, wiped out file allocation tables, wiped out Bioses, wiped out PCs. In comparison, todays "malware" seems rather tame or even benign.
I can't wait until one of these is widespread AND badly written. Once several thousand computers stop booting and are potential ruined (umm... you need a new motherboard... this is not covered under warranty). God help whoever wrote and distributed it. He will hang.
In other words, at no point is the actual title of any windows transmitted.
Let's review this situation:
It amazes me that such a transparent piece of bullshittery could have got as much press as it did, given that it's clearly a case of him trying to spite Blizzard after they shut down the money-making business of Wow!Sharp (it only went open source after they felt it had become useless). Ever since this sordid incident, Hoglund has been a dirty name to me and many others familiar with it, and I don't trust him at all.
Like I said, it wouldn't surprise me a bit if he released code showing how to hack the BIOS, just like he teaches people how to write rootkits despite them having (as far as I'm aware) no legitimate uses.
And what, exactly, would a rootkit or virus want with the BIOS?
A very insightful question—and one with a scary answer. Currently, if I have a machine that's infected with a rootkit/virus/other malware, I can boot Knoppix or other favourite live CD of choice, and be sure that the malware isn't running (and thus can't prevent me detecting/removing it, log my keystrokes, wipe my HD, or any other things I'd rather it didn't do). Once malware starts overwriting the BIOS, I can't even be sure of that: as soon as I apply power to the machine, it's already compromised...
Need to type accents and special characters in Windows? Use FrKeys
Actually, I think it's more because no-one has bothered yet. Users who are incompatible with moving jumpers around are likely also incompatible with BIOS updates.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.