Slashdot Mirror
NIST Publishes Draft Guidelines For Server BIOS Protection
hypnosec writes "The U.S.'s National Institute of Standards and Technology has come up with a set of proposed guidelines for security of server BIOSes— the mechanism on which most modern day computers rely during boot up. Recently quite a few instances of malware have been known to persistently infect computer systems, and cannot be removed even on OS re-installs. NIST is proposing a set of measures through which the BIOS can be made more secure and resistant to such firmware manipulating attacks. Mebromi is one such Trojan. NIST published the draft guidelines [PDF] earlier this week and has proposed four different features through which the server BIOSes can be made more secure: authenticated update mechanism; secure local update mechanism (optional); firmware integrity protections; and non-bypassability features."
Locking the BIOS with signed updates and crap is exactly the wrong way to go. It means there will still be bugs to exploit. But the forces seeking to lock down the PC will advance yet another step under cover of security theater.
The correct solution is to give the machine a one way gate so that after POST the BIOS can't be updated, period. Electrically impossible. That would require an updater in the BIOS and either storing the extended config now flashed into the same chip with the BIOS to either go elsewhere or the flash chip to be smart enough to have a protected area and an unprotected area and only the protected area be unrevokable without a full reboot. It also should go without saying that the BIOS can't look at the unprotected area before the big switch to prevent buffer overflow attacks from getting into the BIOS while the flash is writable and/or stopping the user from invoking a clear extended data function.
A minimal rescue program in mask ROM would be gravy of course. Lets see the leet warez doodz get past that one. Wouldn't put anything past the NSA though.
Democrat delenda est
Step one: Kill UEFI with fire.
Step two (optional): Everything else.
I'm perfectly serious -- If you have UEFI, it doesn't matter how secure everything else is, you're screwed, and you're screwed because Microsoft asked the companies making the motherboards to screw you for the sake of adding yet another failed DRM attempt to their next operating system: Windows 8, "Explode On Launchpad Edition".
#fuckbeta #iamslashdot #dicemustdie
So glad this is finally being taken seriously! I've often wondered why we don't see more persistent infections given how firmware is handled these days.
Earn Cash and Prizes, and get free stuff!
Why is the government proposing any standards for computer BIOSes? Can you say backdoor? Can you say "abuse of the Commerce Clause" ?
I want to delete my account but Slashdot doesn't allow it.
I think for high-end hardware for servers and stuff, an RS232 serial port only accessible when enabled for updates should be the only conduit for installing BIOS updates. Think of it as a management port. Us network guys do this already via SSH, Telnet and TFTP and you guessed it, SERIAL already. I don't know of any virus's able to jump a physical divide like a serial port.
-------- -1 for SUCK IT!
To put it very simply, servers need to be able to resist things like Blue Pill and other advanced persistent threats.
This is vital for secure data processing and storage, and therefore needed by many organisations, businesses and governments.
I can't wait until the first good, fairly inexpensive servers come with this option. That's the point at which I'm changing career paths over to Sales ;-)
I'm a dreamer, the world is my playpen. But hey, I'm a serious person, I can't dream all the time.
Computers, especially servers, need a guarenteed-clean factory reset procedure.
How it might work:
IF you boot with a certain jumper set, an immutable "rescue BIOS" boots the computer into a "recovery mode." This may be as simple as booting off of a specific location, such as the first n sectors of whatever is on SATA drive 0. The "rescue BIOS" doesn't need to be any more complicated than a read-only copy of the real BIOS using factory-default settings instead of the "BIOS settings" the user or virus set.
IF you have a known-clean, preferably but not necessarily digitally-signed boot disk attached, you will be able to clean your BIOS, and, once that is clean, the rest of your system. Presumably the vendor would supply a bootable DVD or CD for this purpose.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Read carefully, this is very important:
Comments on this publication may be submitted to:
National Institute of Standards and Technology
Attn: Computer Security Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
A physical jumper would cost extra money. How about a NON FLASHABLE bios? - we used to have them. We used to have non shitty programmers that could write code that didn't have to be updated every 6 months. There was a time a flashable bios was justified. Now it's just a cross between laziness and DRM.
Seeing this article reveals we have some very stupid people in some very high places in the IT world.
I find interesting that the draft cites a Phrack issue. If a NIST cite do not legitimize a journal, I don't know what it does.
how about this: make bios read-only, and include a momentary push button that needs to be pushed in order to make the bios writable for a limited amount of time. Is this too simple?
Congress has the power to ' fix the standard of weights and measures' by the constitution. NIST is the body that does that. They also happen to pay for a lot of measurements of material properties (density, hardness, etc) and publish them online for free. NIST does sometimes publish standards, but those standards don't carry the force of law, nor can NIST pass laws about the standards. If you want to be paranoid about government overreach, just watch congress, they're the ones that make laws.
A physical jumper would cost extra money. How about a NON FLASHABLE bios?
No, sorry that's crazy. BIOS updates are essential to fix security bugs. A non-flashable bios would make your system *more* insecure.
The physical jumper would help in some situations, but not all, let me explain: I'm one of the guys cited on that draft, we made a pretty generic bios rootkit that worked fine. One of our attack scenarios inclueded having physical access to the device before the victim, I.E. you receive an already rootkited laptop/PC. A jumper wont help in that case, only a signed BIOS would. It sucks because it smells a lot like DRM but very often security and freedom are mutually exclusive.
Hardware jumper.
Jumper on. Bios is read/write.
Jumper off. (default) Bios is read only. Period. No exceptions. Not possible to write when its off. At all.
Done and done. No signing anything needed. 100% under the control of the machine owner.
Too hard? Make it a fucking button somewhere. Too insecure? Make it a key lock.
One of our attack scenarios inclueded having physical access to the device before the victim, I.E. you receive an already rootkited laptop/PC. A jumper wont help in that case, only a signed BIOS would.
And when the attacker inevitably finds an exploit and installs a rootkit anyway, they'll change the keys so you can't install the officially signed BIOS.
And when the attacker inevitably finds an exploit and installs a rootkit anyway, they'll change the keys so you can't install the officially signed BIOS.
Exactly. You can't really protect a generic computer from unknown software bugs. Also if you have physical access is game over anyway, you could replace a big enough piece of hardware with a malicious one and that's it, pwned.
With Intel chipset, i could say only one thing: FORGET about security. Why? Pretty simply, the chipset itself is with already built-in remote control module. Even before booting. Oh, nooo, not true, even if the computer is shut down (but is still connected to the power socket of course).
You should only update your BIOS when you mean to. I'm of the opinion that it's something that you should mean to do, not something that should just happen automatically ever. So it doesn't need to be writable 99.999% of the time. So how about a switch that toggles the write enable pin to your bios flash on the front panel of your box?
Want to update your bios? Power down box. Insert CD or USB key. Flip write enable switch. Power up. Flash bios then power down. Flip switch to write disable. Boot.
And for an added measure, don't let the thing ever boot from an MBR if the switch is in "write" mode.
Easy peasy.
Weaselmancer
rediculous.
This is probably the way to go if a jumper is going to be required. You get a bunch of servers in a rack or cabinet and it starts getting complicated to get to the jumpers. But I would make it open nothing closed flash. This way if the wires to the switch get pinched and cut for some reason, it fails to safe (open- no flash).
No we didn't, we had bugs that went unreported and code that didn't get fixed, ever.
hopefully its a little more thought out than their report on 9/11
If that scenario, the victim is screwd no matter how securely the bios is protected. Any attacker good enough to hack firmware should be quite capable of exploiting the hardware itsself. Time-delay system-killers, a hacked network card that starts sending duplicate packets to any IP that gives it a key string of bytes, a keylogger that stores the passwords entered when installing the OS for later retrieval (Possibly via hacked network card). It can all be done, because things like that have long been done to games consoles to make modchips.
This is idiotic. Back when those non-flashable BIOSes existed, the BIOS was damn tiny. These days it's still got all that legacy code, while also handling ACPI, power management, fan speed, configuring CPU/PCI/RAM bus speeds and multipliers (instead of jumpers of dip switches), as well as safety features like detecting when a system doesn't boot and going into safe mode so you can change those CPU settings again. The BIOS gets pressed into other use as well, including enumerating the USB bus to find bootable devices, managing settings for on-board graphics and sound, and even work-arounds for design bugs in CPUs.
No, it's pretty clear the stupidity is localized right here on /.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
you receive an already rootkited laptop/PC. A jumper wont help in that case, only a signed BIOS would. It sucks because it smells a lot like DRM but very often security and freedom are mutually exclusive.
If the bad guys had access to the internals of the computer, they could just physically replace the ROM chip, no? And they could make the hacked BIOS look exactly like the original. Even if the ROM chip wasn't removable they could connect their flasher device directly to the pins of the chip.
Given that the BIOS/UEFI is responsible for all the following:
- implementing the braindead ACPI spec which is often prone to bugs
- housing laptop's EC code in some systems which controls power management and the fans (not unheard of this to have bugs)
- responsible for applying installed CPU microcode updates (fixing CPU bugs before the OS starts)
- faking nonexistent hardware on dirt cheap systems via SMI (not sure if this is common anymore, and bugs may lurk here)
in my humble opinion updating it is necessary from time to time, especially on OEM systems, to suggest a BIOS update as part of troubleshooting or issue resolution. It's nice to be able to do this remotely in some capacity rather than have to travel 450 miles to flip a hardware switch.
This being said, can't they put the BIOS on an SD card now? Is a LPC (or whatever) to SD converter/translator whatever really that hard/expensive to build?
This would allow hardware manufacturers to provide a UEFI compliant firmware for Windows, etc., let me completely replace it if it gets borked or infected, and let hackers have their way with it as well.
BIOS was damn tiny.
exactly. increasing a systems complexity for the sake of convenience is counter to security. It was called a BASIC IOS for a reason.
I can't guarantee that existing code is 100% non exploitable, but if you can't get it right after 30 years, you should be doing something else.
This whole security scare is a false dilemma, people who need secure systems know how to do it. Companies who need to reinvent market share know how to do that too. There is a reason we use physical keys to control nuke's, rather than, say a garage door opener.
You're the one making this a false dilemma... between absolutely zero security, and nuclear bunker-level insane security procedures.
Your bank absolutely is not going to go for nuclear bunker-levels of security, yet a pretty good amount of security is needed there. Your proposal is... nothing.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Signed updates make 100% total sense.
Because keys never get leaked or cracked, right? That never happens. Now if you'll excuse me I'm off to go watch a blu-ray movie on my Linux box.
Weaselmancer
rediculous.
Large environments require BIOS updates more than the average user, and may require some type of update across hundreds of servers (or more) if a bulk-purchase was made. These need to have the ability to be scripted. A solution sacrificing both convenience and security would be to require a BIOS password to be set on first boot. This could be scripted so that when a server comes into a corporation, it gets a BIOS password, and then this password is required to write any BIOS (or even firmware-level update) to the system. Then the issues are losing the password - which could then employ a jumper to reset - and the encryption level of the BIOS password, which would be interesting after few years.
So, for starters, people appear to confuse secure boot functionality in UEFI with secure BIOS upgrades. The former is required by new Windows 8 hardware profile and is provided as specified by the UEFI standard. The latter is what the NIST spec is talking about---to prevent firmware malware attacks. The idea is simple---during normal operation BIOS is readonly; firmware updates write the new image to a temporary area, and upon reboot the old firmware takes over, realizes that there's a new firmware available, cheks the crypto signatures to ensure the provenance of the bew image and flashes it if they're OK. Unfortunately, there's no single implementation and AFAIK no common signing scheme---this stuff is proprietary and board-specific. NIST spec might make it saner, by requiring conforming implementations. Does it prevent firmware exploits? Not quite, because there are option BIOSes that reside on PCI cards and such, and AFAIK they are not covered by the BIOS spec. Is it better than a jumper solution proposed here? I believe so: I don't want to go back to the old days of having to crack open the box and boot DOS from floppies; they may work for a single machine or two but are not scalable for realistic largish deployments.