Commentary

George Hulme
 

Serious, Stealthy, Deadly BIOS Attack

After covering IT security for well more than a decade, few new attacks scare the freckles off of my back. This persistent BIOS attack, as demonstrated by Alfredo Ortega and Anibal Sacco from Core Security Technologies is one of these new attack techniques.

After covering IT security for well more than a decade, few new attacks scare the freckles off of my back. This persistent BIOS attack, as demonstrated by Alfredo Ortega and Anibal Sacco from Core Security Technologies is one of these new attack techniques.One of the scariest malware trends in recent years has been the rise in attention toward rootkits. However, it hasn't been easy developing rootkits that can go undetected. Yet, as they detailed at last week's CanSecWest security conference, it's possible to infect the low-level system instructions of a PC BIOS (basic input/output system) and be undetectable.

Essentially, the BIOS is the instruction set given to the computer before the operating system has loaded -- which also means long before any anti-malware software is protecting the system.


More Security Insights

White Papers

More >>

Reports

More >>

Webcasts

More >>

According to the researchers, they insert a small piece of code into the BIOS, and they get complete control of the machine. Most disturbing: the code inserted in the BIOS will survive through re-boots, hard-drive wipes, and attempts at reflashing the BIOS. Ortega and Sacco demonstrated successful attacks on Windows, OpenBSD, and on an OS within WMware Player.

From an entry at the ThreatPost blog:

"It was very easy. We can put the code wherever we want," said Ortega. "We're not using a vulnerability in any way. I'm not sure if you understand the impact of this. We can reinfect the BIOS every time it reboots."

The good news is an attacker needs to have a machine where they have "root" privileges, or they need physical access to a machine. While this attack won't be prevalent over the Internet: would you know if the BIOS in one the machines on your corporate network was altered, and infected in a way that no traditional firewall or antimalware application would pickup?


Related Reading




Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

InformationWeek encourages readers to engage in spirited, healthy debate, including taking us to task. However, InformationWeek moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing/SPAM. InformationWeek further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.
T-Shirt Giveaway T-Shirt Giveaway: Each week we're selecting one great comment from our readers. The author of the comment will receive an InformaitonWeek Community t-shirt. So get posting!
Subscribe to RSS

Resource Links