Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question arises from trying to understand new types of spyware that target the system bios and/or network card.

Is the system bios and ethernet card both protected by an OS firewall set to deny all incoming connections? In other words, are these two components exposed to the network when connected straight to the internet, or do they function within the firewall protection?

My concern is if it is possible for someone to remotely access the system architecture of a computer without having to defeat the firewall, and if so, how do you protect the bios and/or network card?

share|improve this question
add comment

1 Answer

Remote attackers have no direct connection with the BIOS. The only point of entry for a remote attacker is to send network packets. Network packets are interpreted by the operating system, and remote attacks work by exploiting a bug in an application or a component of the operating system itself.

Firewalls protect against remote attacks only if they block access to vulnerable applications. If you're running an Apache server and there's a vulnerability in your version of Apache, a firewall will not protect you since it has to allow HTTP requests to go through.

It is possible to have a bug in the network card's firmware. This is rare, but it has been known to happen. If the bug affects the way the network card handles packets before it transmits them to the operating system, the operating system's firewall will not help. One potential source of vulnerability is Wake-on-LAN and similar protocols if implemented incorrectly. In this particular instance, a machine is vulnerable only when it is plugged into the network but turned off! The way to protect against such attacks is to block wake-on-LAN packets from untrusted sources with a network appliance located between the machine and the hostile world.

share|improve this answer
    
Thank you for the info. So a card such as the Broadcom® 5754 Gigabit Ethernet LAN solution 10/100/1000 Ethernet with Remote Wake Up and PXE support could be exploited such as you described? Is there a recommendation for a more/most secure ethernet card? –  Newcastle Oct 9 '13 at 2:01
    
You can disable wake-on-LAN and boot from LAN in your BIOS. AFAIK, there is no such thing as a "secure network card". –  Matrix Oct 9 '13 at 9:19
2  
@Matrix Actually disabling wake-on-LAN in the BIOS is not enough. AFAIR there is/was at least one vulnerable model where if WoL is disabled in the BIOS, all that means is that the BIOS ignores WoL signals from the network card — but the network card would still process WoL packets as long as it receives power, i.e. as long as the computer is plugged in. –  Gilles Oct 9 '13 at 10:05
    
This isn't always true. For example, many servers have IP-KVM or similar built in, and the Ethernet hardware diverts those packets before the OS ever sees them. (Some have a dedicated port, some share a port, some have an option in the BIOS to pick a port). –  derobert Oct 15 '13 at 21:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.