Tag Info

Hot answers tagged

12

Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data). If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...


11

It is certainly conceptually possible for a virus to attack firmware such as video BIOSes. The virus would have to be tailored for each firmware, so there would have to be a large variety, but that's only an economic argument, not a technical argument. The economics means that you're only likely likely to see firmware viruses in targeted attacks (where at ...


11

It is certainly possible. See this presentation for example: http://www.coresecurity.com/files/attachments/Persistent_BIOS_Infection_CanSecWest09.pdf One way to achieve protection is by requiring a flash bios password that some implementations support. Another way is by using a TPM which does almost exactly what you are suggesting: It creates a SHA-1 hash ...


11

In principle, you could modify the SoC (System on Chip)'s firmware (e.g., the simple bootloader that initially tells the chip to read the SD card to get the real firmware image to boot up) by uploading new malicious firmware which would persist after replacing the SD card. However, I am not sure if the Raspberry Pi's SoC firmware is (easily) modifiable. I ...


11

The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...


11

Remote attackers have no direct connection with the BIOS. The only point of entry for a remote attacker is to send network packets. Network packets are interpreted by the operating system, and remote attacks work by exploiting a bug in an application or a component of the operating system itself. Firewalls protect against remote attacks only if they block ...


10

An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...


10

It's not impossible; Intel CPUs have had the ability to have new microcode uploaded into them for some time, and there are open source programs that can do so. If someone can then decipher the microcode, they could then produce modified microcode with a different CPUID string embedded in it. (It's supposed to have a checksum to prevent that, but I wouldn't ...


9

It depends on how the BIOS chip stores the password. If the BIOS chip stores the password in battery-backed RAM then removing the battery will clear the RAM which will restore the BIOS defaults. For most chips the BIOS default is to not require a password. If the BIOS chip stores the password in an external Non-Volatile Memory chip (usually EEPROM) the it ...


9

"Celeron" is a brand name which Intel has applied to dozens of distinct processor designs. In particular, a number of dual core processors have been sold under the name "Celeron" (which, in Intel-speak, means "cheaper and reduced", but not necessarily "mono-core"). So your sales guy may have sold many Celeron "posing" as dual core processors because they are ...


9

If you remove the boot from CD and USB from your BIOS boot order it does increase security. Anyone cant easily drive by boot your machine when you are not there and copy all your hashes and sensitive information. If you lose your BIOS password there is usually mechanisms to reset the BIOS back to default. Usually this involves opening the machine and using ...


8

First, APT does not refer to exploits, rootkits etc., but to the threat actors and the organisation behind them. That said, bios and firmware attacks have been around for a while. The only change here is the same one any class of attacks goes through: they have become commoditised. This doesn't change the approach of find, patch etc., but it does ...


7

Best option is just to encrypt the Linux partition, e.g. with LUKS. That way the Windows 7 partition can't actually access any of the data on the other partition. Technically it can still read and write to the partition (there's no way to prevent this) but the data it sees is all encrypted.


5

A well designed TPM should be pretty resilient to tampering, but a truly determined attacker could try doing something like dissolving the casing and reading information directly off the chip. It's a pain staking and highly technical process, so probably isn't a likely case in most situations, but if the value of the material is known to be high enough, it ...


5

Your questions is about preventing the inclusion of hardware that contains intentionaly created backdoors, but I suggest that in addition to prevention you consider detection, mitigation, and response. There are different levels of sophistication in creating and detecting hardware backdoors. So, in part you need to understand your own level of expertise in ...


5

Interesting range of questions here, which you may need to address separately. Is booting from a freshly downloaded Linux CD safe? Relatively safe, as long as you download from reputable source and check the hash you can be confident it hasn't been tampered with in transit. There is a small chance the source may have been tampered with, so you should be ...


5

My first question to you is, what are the chances of someone writing a virus to infect SCADA systems? And then there was stuxnet.... As for your question, it is possible. The normal call back for this issue is the 2007 blackhat demonstration about hardware hacking. Here are a couple articles that hit on that demonstration... eweek, zdnet. Frankly, when ...


4

Using a rootkit someone can make their hardware appear as anything. The amount of memory available or processor speed/type can be easily influenced. This is very useful if you want to store data on the drive whiling hiding its disk usage. Hypervisor rootkits work on modern systems, you should check out the Stoned Bootkit. The QEMU Virtual Machine can ...


4

The TCG Trusted Computing concept devices the BIOS into two parts. The initial BIOS is assumed to be secure and will initialize the TPM. This so-called CRTM will then measure the remaining BIOS components and log their values in the TPM. From the spec it appears that CMOS data is part of that measurement and is stored to PCR1. But since a changed BIOS ...


4

BIOS Most memory chips I've worked with have a W or R/W pin which selects the write mode. Physically tying that one to appropriate logical level should do the trick. Write-protected USB drives I'm a bit suspicious about this one. I've implemented microcontroller<->SD card interface, and the "write-protect" bit is handled completely in software, so you ...


3

Your question essentially boils down to risk management. The simplest way to analyse a particular risk is to see where it falls in terms of the following three categories: Probability - What's the chance that this risk will become a problem? Impact - If a problem occurs due to this risk, how much of a problem is it? Cost - How much will it cost to reduce ...


3

You are mixing up two technologies here it seems. First, there is UEFI and its Secure Boot feature. Secure Boot can be used to assure that your boot loader and your OS kernel are not tampered with. In order to do so, your boot loader and kernel need to be signed digitally and your UEFI configuration must contain the certificates/signatures needed to verify ...


3

--- this is comment, not an answer --- http://www.intel.com/design/mobile/platform/downloads/Trusted_Platform_Module_White_Paper.pdf BIOS Code The TCPA specifies the measurement of integrity of BIOS code at system startup. In order to accomplish such integrity measurement and reporting, the system BIOS has to be enhanced with integrity measurement ...


3

Nessus does not have a plugin for that CVE. You can check this using the Nessus plugin search. I don't know about the other tools. In theory it is possible to detect these issues on an authenticated scan, as you can do a WMI query for the BIOS version. It may turn out that there are particular difficulties that prevent this; perhaps the BIOS version doesn't ...


3

What you're referring to is theoretically possible (i.e. malware which replaces your computers BIOS keeping it's operation intact but adding malicious functionality), but it is very non-trivial to pull off this kind of attack. The attacker would need to be targeting you specifically as there's really no such thing as a general BIOS that they could place ...


2

That said, bios and firmware attacks have been around for a while. The only change here is > the same one any class of attacks goes through: they have become commoditised. This doesn't change the approach of find, patch etc., but it does mean that a c>ompromised machine may require cleaning at firmware and hardware level, not just OS. ...


2

Yes, I think it is safe to assume that a VM will prevent guests from updating the CPU microcode of the physical CPU. Updating the microcode on an Intel CPU involves executing the WRMSR instruction, with MSR 0x79. This is a privileged instruction, and can only be executed when the CPU is in privileged mode (CPL=0). The virtual machine monitor (VMM) should ...


2

I think you're looking at the problem the wrong way. BIOS flashing as part of malware is immensely uncommon, and is usually only found as part of some kind of sophisticated APT-style attack. Remember that the BIOS image isn't generic across all motherboards - it varies based on the type of interrupt controller, DMA controller, southbridge (chipset), memory ...


2

I can't answer specifically to the Raspberry PI but I will refer to this article. According to that it is possible to write malicious code that wouldn't be cleaned via "typical" procedures. Due to the efforts of programmers that have contributed to those projects, Rakshasa works on 230 different models of motherboard..


2

How about Firewire DMA? Firewire (a.k.a. "IEEE 1394") allows direct memory access by at least some kinds of devices. People have writte lots of attack tools for lots of devices over the years, so it should be possible to hide in a Firewire device. To confirm your PCI device hypothesis, it looks like John Heasman implemented a PCI rootkit, which pretty much ...



Only top voted, non community-wiki answers of a minimum length are eligible