Attackers could use the PC's Advanced Configuration and Power Interface, a collection of power management controls, to code or deploy snippets of a rootkit into the BIOS flash memory, a researcher says.
Attackers armed with rootkits may hide some of their malicious code inside the PC's BIOS flash memory, a researcher said at this week's Black Hat conference, a tactic that would make it tougher for defenses to detect the cloaking, and infecting the computer permanently, even if the operating system's reinstalled.
John Heasman, principal security consultant for U.K.-based Next-Generation Security Software (NGS), laid out the threat in a presentation Wednesday at the Black Hat conference in Washington, D.C.
Attackers could use the Advanced Configuration and Power Interface (ACPI), a collection of power management controls, and its programming language to code and/or deploy snippets of a rootkit into the BIOS flash memory. Hackers could even replace legitimate functions in the ACPI's language with their own, malicious, operations, said Heasman.
Among the dangers of such BIOS rootkits, he added, were that they were immune to reboots -- eliminating the current practice of hackers re-running the code each time the machine starts up, one way security software sniffs out malicious code -- weren't detectable on the drive (which current security software spends most of its time examining), and could survive disk reformatting and operating system reinstallation.
To defend systems against such strategies, Heasman said systems could be set to prevent BIOS memory reflashing (usually done by resetting a jumped on the motherboard) or shifting to computers with use signed BIOS, such as Phoenix Technologies' TrustedCore or Intel's SecureFlash.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.