Slashdot Mirror
Researchers Demo BIOS Attack That Survives Disk Wipes
suraj.sun writes "A pair of Argentinian researchers have found a way to perform a BIOS level malware attack capable of surviving even a hard-disk wipe.
Alfredo Ortega and Anibal Sacco from Core Security Technologies — used the stage at last week's CanSecWest conference to demonstrate methods (PDF) for infecting the BIOS with persistent code that will survive reboots and re-flashing attempts. The technique includes patching the BIOS with a small bit of code that gave them complete control of the machine. The demo ran smoothly on a Windows machine, a PC running OpenBSD and another running VMware Player."
If BIOSes, CPUs, and other low-level software had factory-reset pins that could not be bypassed through patching, we wouldn't have these problems.
If the pin is set during POST, the CPU, BIOS, or whatever would reset itself to factory conditions. The device would be configured so the factory-reset sequence could not be tampered with through software updates alone.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I think the point is that once this happens that you cannot fix it by reflashing the BIOS.
We've had evil viruses around for a while. Anyone remember
W95.CIH? Back in the Windows 95 days, this mean son of a bitch could nuke your BIOS from orbit. And we're talking over a decade ago.
Computers are still chugging along fine. This will probably end up breaking more computers than it ends up hijacking. A broken computer is one that gets flagged and fixed or throw away.
Them Old Time Viruses ran with a lot less then what modern BIOS have, so I wouldn't focus to much on size to save us.
When the Virus initially runs it is probably in the Hard Drive to the RAM which can can fit a LOT of configurations to break into a lot of BIOS manufactures.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Getting root (administrator) privileges in Windows appears trivial for most current malware, so getting to the BIOS is not that hard from there.
It makes me more wonder why doesn't a motherboard have a jumper that disables BIOS updates? That would be quite a strong safety measure. Anyone capable of knowing why to, and how to execute a BIOS update is certainly capable of opening/closing that jumper for the procedure.
(although I couldn't see how it can survive a re-flashing.)
Presumably reflashing the BIOS is normally performed by code within the BIOS. If you can corrupt the code in the BIOS you would have control over the flash programming, so could prevent the user from overwriting the infected blocks. I doubt this refers to physically removing the PROM and reflashing with an external programmer.
If I seem short sighted, it is because I stand on the shoulders of midgets
Does anyone use EFI outside of Apple and IA64 based machines?
Microsoft don't support EFI, even tho Vista promised support for it... EFI is really only of benefit to run OSX or possibly Linux.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Because adding that useful safety feature might cost a WHOLE NICKLE!!
Similarly, I have seen a number of chipsets where the top and second from top erase blocks can be swapped just by pulling a logic line down (with a jumper for example). The idea is that even a screwed up re-flash of the boot block can be recovered easily just by setting a jumper.
Too bad I have NEVER seen a board that actually hooked that line up nor a BIOS image that had a second emergency boot sector programmed.
You're being watched . . .
The fact that this was allowed to happen is clearly a defect in design, materials, or workmanship.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Better question is what typeof BIOS?
Your many hours of programming C/C++ betray you :-)
It all depends on the BIOS of the machine, which is not supposed to be able to be accessed while operation of the OS, some of the newer ones might, but early 2000 we saw some machines coming out with BIOS that was not reachable by the OS, only when you booted from disk, that was the only time you could do a firmware upgrade, I blame the community for pushing to have everything "easy"...is it not easier to be able to update the BOIS, from inside the OS... I say no, it is not a task you should be doing so easily anyways, flashing a BIOS is last measure, and updating the BIOS, (especially if you can easily brick a computer) is not something to be done often.
I wonder how many mainboards are out there which have their Flash write protect disabled straight from the factory. Many people probably don't even know their system has one ("Jumper, whaddoyoumean jumper. I know that movie, but that's probably not it."). Shudder...
The Hacker's Guide To The Kernel: Don't panic()!
Every motherboard I've ever worked with either had a BIOS reset jumper or the CMOS battery was removable.
You've never worked on a laptop.
Request a Linux Shockwave player here: http://www.macromedia.com/support/email/wishform/