Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Steve Gibson of Security Now fame claims that viruses can attack a video card and infect it. I assume that he means it can infect the Video BIOS. However I'm skeptical. BIOSes are so numerous and different, what are the chances of someone writing a virus to infect the Video BIOS?

Any clues?

share|improve this question
Without a proper context, my guess is that he is referring to attacking the GPU and it's associated memory. It is possible, but that depends on what qualifies as an infection. – Steve Jul 20 '11 at 19:19
It wouldn't surprise me much to learn of viruses on video cards. But it would help if you could provide a link to the story you're referring to, and provide key quotes so we don't have to wade thru podcasts. Note also that he doesn't have the best reputation: Steve Gibson: a "fringe charlatan" who "seems to know enough buzzwords and ideas to be dangerous to his clients." – nealmcb Jul 20 '11 at 19:25
Since he posts transcripts (this one should be up in a day or so) why not examine what he said before the reference to charlatan on this site yet again. There is a similar question on StackOverflow with a different, more positive, take on the question. He also addressed the issue episode 292 quoting an Al Jazeera Let's review today's transcript before slamming the dude. Then let's talk about the history of both good and bad since they are the source of the charlatan listing. – zedman9991 Jul 20 '11 at 20:25
@nealmcb, No one can be right all the time. Those who don't ever make wrong assertions likely have made none. Steve Gibson has real skills; the programs on his site are all written by him alone. – Pacerier Nov 11 at 0:02

3 Answers 3

It is certainly conceptually possible for a virus to attack firmware such as video BIOSes. The virus would have to be tailored for each firmware, so there would have to be a large variety, but that's only an economic argument, not a technical argument. The economics means that you're only likely likely to see firmware viruses in targeted attacks (where at least part of the virus development is specific to one target) or in attacks against popular, standardized hardware platforms (iPhone attacks technically count here).

For an example of a real firmware vulnerability, try CVE-2010-0104: Broadcom NetXtreme management firmware ASF buffer overflow. This is a bug in some Ethernet firmware that allows a remote attacker to take control of the network firmware (and so at the very least actively attack all network traffic), and potentially of the whole computer (I don't know if there's an exploit for that, but once you have access to the PCI bus, I doubt that much is barred). Interestingly, the bug is in a remote management protocol parser, which in particular handles wake-on-LAN — so a computer is more likely to be vulnerable when it's switched off.

At Black Hat USA 2012, Jonathan Brossard presented “a generic proof of concept malware for the intel architecture, Rakshasa, capable of infecting more than a hundred of different motherboards”. The proof-of-concept (not publicly released) infects many BIOSes and common peripherals including network chips. It's only a matter of time until someone adds support for video cards.

share|improve this answer
So what are the ways to "fully reformat" the system to ensure that it's virus free after it has been infected by bios viruses and video card viruses? – Pacerier Nov 10 at 23:57
@Pacerier Reflash all firmware that can be written to a flash memory. It's difficult to be confident that you got it all. Depending on the device it may well be that the infected firmware can arrange to pretend a successful reflash but the malware stays behind, in which case replacing the hardware would be the only solution. – Gilles Nov 11 at 0:08

My first question to you is, what are the chances of someone writing a virus to infect SCADA systems? And then there was stuxnet....

As for your question, it is possible. The normal call back for this issue is the 2007 blackhat demonstration about hardware hacking. Here are a couple articles that hit on that demonstration... eweek, zdnet.

Frankly, when it comes to video cards in particular, i have no solid evidence either way. I would not think of it as a major threat at this time. Personally i have no doubt that video cards could be used for persistance, the only question is when will we find the first one in the wild?

Also, if anyone knows of an actual case of this in the wild, i would love to hear of it.

At the moment, i'm more afraid of a technology company being compromised that produces memory sticks than one that produces video cards. If you're looking for money, then you're going to go after the easiest route, and that seems like an easy choice at this point. If i remember correctly there was a sandisk incident similar to what i just mentioned, though i haven't done any research to back that up.

share|improve this answer
4 also discusses malicious use of a video card EEPROM – Ormis Jul 20 '11 at 19:40
Re SCADA, we've been saying for YEARS that it is highly likely. I've heard laments re the state of SCADA systems since I began being aware of security as an industry... I'm actually more suprised that it took so long. – AviD Jul 21 '11 at 10:01
I guess it wasn't the best example, i was simply trying to make a point that those type directed attacks are a reality. – Ormis Jul 22 '11 at 13:36
Fair enough, it's not like many listened. :). For all intents, what you said is correct, and explains your premise well: just because you dont expect there to be a virus on a "niche" platform, doesn't mean there wont be one soon enough... – AviD Jul 22 '11 at 13:37

IHVs extend BIOS by hooking interrupts and providing new code, via Option/Expansion ROMs, a blob stored on the IHV's flash ROM. On UEFI, they don't use BIOS blobs, they use UEFI drivers (PEI Modules, DXE Drives, UEFI Drivers). Malware authors can target BIOS Option ROMs and UEFI drivers. LegbaCore recently said they're working on an Option ROM verification tool: HTH, Lee

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.