Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Are there any known instances of malware persisting past a drive wipe and reinstall, through modified bios, or firmware on one of the machine components?

share|improve this question

marked as duplicate by Gilles, Adnan, NULLZ, TildalWave, AJ Henderson May 26 '13 at 18:40

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
Sorry, I'm too knackered to write a proper answer (4:30am here LOL) so a comment with a link to an IMO interesting article will have to do for the time being. It's about a Black Hat 2012 presentation by Jonathan Brossard, and includes some additional links and a complete 70 slides long Def Con 20 presentation. A small antipasto before someone drops a proper answer. Cheers! ;) –  TildalWave May 26 '13 at 2:32
1  
Yes. –  Adnan May 26 '13 at 6:09
    
Actually, I'm rather curious whether it makes sense to make such malware - both for APTs and kiddies. Even as a way to inflict financial losses it may be not really successful. –  Deer Hunter May 26 '13 at 8:21

1 Answer 1

up vote 3 down vote accepted

Yes, there are at least several instances of lab based malware which is capable of infecting firmware and BIOS and at least one rootkit in the wild (Mebromi as Adnan pointed out in his comment.) They are still pretty rare, but they do exist.

share|improve this answer
    
Any examples of these? –  Cybergibbons May 26 '13 at 7:52
2  
There's some new research that shows the TPM can be used to rootkit the BIOS, and Mebromi as AJ and Adnan alreaday mentioned. –  Polynomial May 26 '13 at 11:57
    
@Polynomial - ok, now that's officially scary (that the TPM can rootkit the bios) –  AJ Henderson May 26 '13 at 18:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.