Beware the BIOS rootkit
Researchers: Rootkits headed for BIOS
A collection of functions for power management, known as the Advanced Configuration and Power Interface (ACPI), has its own high-level interpreted language that could be used to code a rootkit and store key attack functions in the Basic Input/Output System (BIOS) in flash memory, according to John Heasman, principal security consultant for U.K.-based Next-Generation Security Software.
The researcher tested basic features, such as elevating privileges and reading physical memory, using malicious procedures that replaced legitimate functions stored in flash memory.
(link added is mine)
The protection for this is VERY simple. Manufacturers should turn of by default the ability to flash the BIOS. And trigger the ability to a jumper switch directly on the mother board. Flashing your BIOS is not a basic maintenance function is a serous thing. That should be done by some one who knows what they are doing. Only those who have the confidence to pull out a screw driver and open your PC should be attempt this.
by disabling this feature by default malware can’t sneak on a PC and flash the BIOS on the sly.
Dap: /.
January 27th, 2006 at 12:17 pm
Beware the BIOS rootkit
Researchers: Rootkits headed for BIOS
A collectio…
February 10th, 2006 at 2:59 pm
Agreed, but I have been wondering about all the other devices in a computer. There is flash in a lot of devices these days, what about those components?
February 14th, 2006 at 11:54 am
BIOS is particularly important because of the positioning, being the first program run when you boot and by the added power being added to BIOS in particular to enforce DRM. It will be a computing platform in and of itself. Of course when you have a new platform for computing you have also one for new kids of malware.
November 15th, 2006 at 10:04 am
I’ve developed a voting system that boots from a floppy. (No hard disk needed.) Because the floppy can be hash-code-checked on any trusted computer, I believe that the only way to compromise its software would be via a modified BIOS. Can you think of any way that a modified BIOS could shield itself from a complete byte-by-byte scan of the BIOS itself?
November 15th, 2006 at 11:39 am
Charles,
I can’t think of any. AFAIK, BIOS is only executed at boot time. Once the hand off is made to the OS it looses any power that it has.