how to protect my data from malware/spyware that infected my BIOS?

Question

we all know that some countries do their best to spy on their citizens and the citizen of other countries and that countries maybe have specialized spying agencies wither they are known or not, and, from my basic understanding that the most effective ways is to infect the HDD or BIOS firmware.

Now the infected HDD can be avoided by using another storage media e.g. USB pendrives and to use live boot OS that uses RAM instead of HDD e.g. Tails OS, But, the real problem that worries me is the already infected BIOS and my question is :

What can I do in order to protect my encryption private keys in case of infected BIOS? please note that I assume that the BIOS is already infected since the governments can modify and temper with BIOS firmware before it is being sold in their country.

Answer 1

IMO, the only way to be sure about your firmware is if you build it and flash it yourself, and don't let system out of your hands. Intel Tunnel Mountain and MinnowBoard are the Intel dev platforms for UEFI. You can build your own firmware on these boxes. If you are concerned about this sort of thing, you might want to use a Novena or perhaps a Purism laptop (their firmware is yet to be determined...), made by OEMs who cater to this demographic. Or use an ARM box, where you can use coreboot or U-Boot as UEFI alternatives, Linaro's compatability list of ARM dev boards often have the ability to update the firmware, and they offer UEFI or U-Boot options. Save copies of your ROM, before and after you go through checkpoints where your box is confiscated, to diff the ROMs. BIOS Diff is a tool for that. Some tools listed here: http://firmwaresecurity.com/2015/07/27/index-to-tool-review-blogs/. Thanks, Lee http://firmwaresecurity.com/feed/

Answer 2

The only way to get control over your computer, that works always, is to physically replace the infected BIOS flash chip with a non-infected one (provided that only the BIOS is infected). It is possible that the flashing utilities aren't infected by the government, so you can perhaps even flash a non-infected BIOS from inside a system, which comes with its own problems to solve like how to acquire such a firmware, or by accessing the needed flashing bus via hardware tools, but generally, there is no cheap way to "bootstrap trust" out of distrust about hardware.

You will have to find out how exactly, and how deeply the government infects your computer with their spyware, and then try to counter that, the only general answer to this is to replace the actual hardware parts.

Answer 3

Look on Phoronix.com for Purism reviews, Michael has done a few blog posts on topic, including some controversy about what Purism is doing with their firmware. Traditional IBVs (Independent BIOS Vendors) like AMI/Phoenix/Insyde have closed source codebases. Intel has Firmware Support Package (FSP) and AMD has ASGEA(sp) which contain the necessary blobs that a firmware solution (like UEFI's tianocore.org or coreboot.org needs to work on their systems. New Linux OEMs (System76, ThinkPenguin, etc.) usually use stock BIOS from traditional IBVs, so 100% blobs. Some vendors, like Sage Engineering and apparently Purism, have Intel FSP source licenses, under NDA, so they can edit the FSP source and alter them, hopefully making things "better" (your definition, configurability or security), but they're under NDA from Intel so they probably can't say much. Open source tianocore (UEFI) or coreboot + FSP blobs is better than 100% closed-source IBV solution, if you like open source code. But today's hardware NEEDS blobs to run, look at the ancient/limited hardware that libreboot (coreboot w/o any FSP blobs) runs on. If a system's firmware has malware, and you've the right physical tools and software to reflash, and the system enables reflashing, and you have access to good rom binaries, or can rebuild new binaries, then you may be able to salvage the system. Else, it becomes a brick to be used as a doorstop. (But send me a copy of that ROM for analysis, see blog for email). Thanks, Lee RSS: http://firmwaresecurity.com/feed