The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, he has taken an infected machine, wiped it, airgapped it, reflashed its BIOS, replaced its disk drive, installed a fresh OS -- and after booting the new OS, it was still infected.
How might such an infection remain? What mechanisms could malware use, to keep its hooks in a machine and survive both re-flashing of the BIOS and re-installation of OS?
I'm of course interested in possibilities for what mechanism Dragos' mysterious malware might be using, but let's not stop there. More broadly, I'm also interested in what mechanisms malware could use to survive wiping of the disk and flashing of the BIOS. What schemes could malware use for this purpose?
This question has implications for how we recover from infection. A standard saying is that, once you've been hacked, "The only way to be sure is to nuke it from orbit" -- in other words, you gotta wipe the hard drive and re-install everything from scratch. Maybe the lesson from this mysterious malware is that even "nuking it from orbit" isn't enough. So, to understand what we need to do to restore an infected machine to a known-good state, it'd help to understand all of the ways that malware could stay resident even after you replace the hard disk and re-flash the BIOS.