Researchers Demo BIOS Attack That Survives Disk Wipes

suraj.sun writes "A pair of Argentinian researchers have found a way to perform a BIOS level malware attack capable of surviving even a hard-disk wipe. Alfredo Ortega and Anibal Sacco from Core Security Technologies — used the stage at last week's CanSecWest conference to demonstrate methods (PDF) for infecting the BIOS with persistent code that will survive reboots and re-flashing attempts. The technique includes patching the BIOS with a small bit of code that gave them complete control of the machine. The demo ran smoothly on a Windows machine, a PC running OpenBSD and another running VMware Player."

Comments

"Researcher" should at least have a clue ...

[Zero__Kelvin]

"We can reinfect the BIOS every time it reboots."

No. You can't. The BIOS is the first thing that is run at cold boot time. If it is already infected then you can attempt to ensure that it remains infected. If it is not infected, your code doesn't exist in the BIOS to "reinfect" it. During a warm boot (aka reboot) the code remains resident so, again, it is already infected, making it impossible to "re-infect". Nice hyperbole though.

"Sacco and Ortega stressed that in order to execute the attacks, you need either root privileges or physical access to the machine in question, which limits the scope."

And I have a penis, which makes it rather limiting when I visit the Gynecologist.

News flash: If one has proximity, anything is possible. If I have unfettered access to a machine then I can ensure that I can continue to have that access. No shit. Write up something worth reading when you can obtain the access sans my permission in the first place, or at least don't try to claim that it is a threat to *BSDs, Linux, OS X, and other secure Operating Systems. I know I'm missing one ... Wind^H^H^H^H err... ahhh... no. I listed all the well known ones I guess.

Re:Fatal flaw: No BIOS reset

[wastedlife]

Good point. The only fix I can see for your problem would be for both BIOS chips to be flashable. After updating and testing the new BIOS revision, then flip a jumper to switch to the backup chip and update that one as well. As long as they are physically separate and only accessable when the jumper is flipped, the backup BIOS should not be affected by this attack.