Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Could it be possible that a virus rewrites my BIOS with some malicious code? If so, how could I protect against it, or at least how can I check that the BIOS hasn't been modified?

share|improve this question
Assuming this is a PC do you know the motherboard make and version? They often have utilities to check on the BIOS. – zedman9991 May 13 '11 at 16:06

2 Answers 2

up vote 11 down vote accepted

It is certainly possible. See this presentation for example:

One way to achieve protection is by requiring a flash bios password that some implementations support.

Another way is by using a TPM which does almost exactly what you are suggesting: It creates a SHA-1 hash of the BIOS image before loading it - and if Secure Boot is enabled it compares it to a stored value.

Now, how to check if the BIOS is compromised:

The general idea is that you can take a BIOS backup image at any time and compare the hash of that image to the hash of a previous one - maybe one you took after flashing.

But, in theory, if the BIOS modification is malicious enough, it will serve you something that won't be suspicious - so you won't actually be able to check but only just re-flash (and this may not be enough if the flash procedure itself uses bios functions that are hooked). Generally to check the integrity of anything, you have to perform the checking operation at a level lower that the level of the object you check. With BIOS this is pretty hard - and this is one of the reasons TPMs were invented.

share|improve this answer
Agree with your points thus +1 but the answer does not address the subject line question for an existing unknown system. – zedman9991 May 13 '11 at 19:53
You are right, I've missed the general case. I'll add something. – john May 13 '11 at 19:56
@zedman9991 Exactly. My main concern is about my wifi router, which is both exposed to the Internet and a common platform for hacking. Yet I have no idea how to get a shell into it to verify it's BIOS. – Jeff-Inventor ChromeOS Aug 23 '14 at 2:24
What's a TPM - please don't introduce TLAs (Three Letter Acronyms) without first spelling out what they are. – Ed Randall Nov 7 at 8:48

Intel CHIPSEC can dump your ROM. Then, you can use CHIPSEC, UEFITool, UEFI Firmware Parser, and some other tools to examine your ROM. If you saved a copy of your ROM when you first got the box, you can start diffing the ROM dumps for changes, to look for malware. Look at how Intel ATR's research on Hacking Team UEFI malware as an example. Look at CHIPSEC's PDF spec for example usage as well. Other tools mentioned above listed here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.