Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It seems to me that to maximise server security, one ought - in addition to the usual security measures implemented in software - to prevent the overwriting of certain parts of the server system, such that only physical access will circumvent this write-protection.

Rationale

If a remote attacker who has been successful enough to gain arbitrary code execution privileges can modify the following, then that server is significantly less secure than it would be if such an attacker could not modify them:

This is a defence in depth rationale.

Questions

My questions are as follows:

BIOS

Is it possible to write-protect BIOS chips at the hardware level, e.g. with a device having a similar form-factor to a BIOS Savior but instead possessing a hardware switch that physically prevents current from reaching the circuitry capable of overwriting the BIOS? (NB: The NSA's "ANT division [has] a clear preference for planting their malicious code [in] BIOS.")

CPU

Similarly, is it possible to write-protect processors at the hardware level, e.g. with a device having a similar form-factor, mutatis mutandis, to that described above for the BIOS, i.e. sitting physically between the CPU socket on the motherboard and, the CPU itself, and again possessing a hardware switch that physically prevents current from reaching the circuitry capable of overwriting the CPU's firmware?

Operating system storage

It is already possible to write-protect the storage medium containing the operating system installation at the hardware level by utilising a read-only optical drive for that storage (e.g. CD-ROM, DVD-ROM, etc). Other options would include write-protected USB flash drives, or forensic USB write-blockers installed between the USB port and the drive containing the OS.

Even though Live CDs are often used for testing or experimentation, this does not seem to be common practice in deployment. Perhaps this is because sysadmins would prefer not to have to gain physical access to every server for every OS update, even if it would just be a matter of replacing a DVD-ROM and rebooting; but I do not share that preference: to me, security is more important.

  • Are there any server OSes/distros designed to support this sort of configuration out of the box?
  • Are there any information resources (books, websites) dedicated to deploying and maintaining servers in this fashion?
share|improve this question
    
CPU microcode cannot be changed permanently; updates must be done by the BIOS or by the OS at each boot. –  CL. Dec 9 '13 at 9:42
    
@CL. Can you elaborate on that (e.g. provide a link)? Thanks! –  sampablokuper Dec 9 '13 at 11:53
    
Intel Architecture Volume 3, section 9.11.6.1: "The effects of a loaded update are cleared from the processor upon a hard reset." –  CL. Dec 9 '13 at 12:55
    
Some relevant discussions: 1 2 3 4 –  sampablokuper Dec 14 '13 at 0:05
    
5 –  sampablokuper Dec 14 '13 at 0:38
show 1 more comment

1 Answer

BIOS

Most memory chips I've worked with have a W or R/W pin which selects the write mode. Physically tying that one to appropriate logical level should do the trick.

Write-protected USB drives

I'm a bit suspicious about this one. I've implemented microcontroller<->SD card interface, and the "write-protect" bit is handled completely in software, so you have to trust some part of your computer to not be able to write there. I do not know if the USB flash drives are the same in this regard, but this is something to keep in mind - hardware switch might still have software protection.

share|improve this answer
    
Thanks. The link in my question is to a discussion of USB write-protection. –  sampablokuper Dec 9 '13 at 11:51
    
Do you know of any resources with more information about the viability of write-protecting common BIOS chips in the way you've described? –  sampablokuper Dec 9 '13 at 12:39
    
It's hard to be specific, and it's been a decade since I've dealt with BIOS chips. It depends from chip to chip. An example of what might be used: MT28F640J3. If you check the datasheet, you see it has WE# signal. The simplest way to prevent writing to this would be to just disconnect the pin from motherboard (possibly with pull-up to Vcc). –  domen Dec 9 '13 at 13:11
    
And that discussion looks good. I shouldn't have said "USB drives", since USB is just one way of interfacing SD cards. "USB blockers" could be tricky, since there are multiple standard ways to transfer files to USB devices. Then there's transferal of other data, and then the all non-standard ways. –  domen Dec 9 '13 at 13:16
    
Some memory chips are read out by feeding the address on one set of pins and reading data on another. Some other memory chips, however, use a "set address" command followed by a "read data at last address" command. Write-protection is more complicated with chips of the latter style than with chips of the former. –  supercat Feb 2 at 23:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.