3 deleted 5 characters in body
source | link

Edit: yes it can be done. As the great answer by Majita Nalis observes, modern systems have a built-in feature that lets you set a boot 'alarm' from software.

A scenario that might also be realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

But after checking WoL and RTC wakeup you're still not completely safe. Most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is actually turned off, and if no clock has been set they fundamentally can no longer exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which doesdo power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

Edit: yes it can be done. As the great answer by Majita Nalis observes, modern systems have a built-in feature that lets you set a boot 'alarm' from software.

A scenario that might also be realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

But after checking WoL and RTC wakeup you're still not completely safe. Most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is actually turned off, and if no clock has been set they fundamentally can no longer exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which does power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

Edit: yes it can be done. As the great answer by Majita Nalis observes, modern systems have a built-in feature that lets you set a boot 'alarm' from software.

A scenario that might also be realistic is the malware gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

But after checking WoL and RTC wakeup you're still not completely safe. Most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is actually turned off, and if no clock has been set they fundamentally can no longer exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which do power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

2 added 100 characters in body
source | link

ItEdit: yes it can be done. As the great answer by Majita Nalis observes, but for most intents and puposesmodern systems have a built-in feature that lets you can safely assume malware cannot directly power on the computerset a boot 'alarm' from software.

SomethingA scenario that is somewhatmight also be realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

To elaborate, mostBut after checking WoL and RTC wakeup you're still not completely safe. Most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is actually turned off, and thereforeif no clock has been set they fundamentally cannotcan no longer exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which does power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

It can be done, but for most intents and puposes you can safely assume malware cannot directly power on the computer.

Something that is somewhat realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

To elaborate, most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is turned off, and therefore fundamentally cannot exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which does power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

Edit: yes it can be done. As the great answer by Majita Nalis observes, modern systems have a built-in feature that lets you set a boot 'alarm' from software.

A scenario that might also be realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

But after checking WoL and RTC wakeup you're still not completely safe. Most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is actually turned off, and if no clock has been set they fundamentally can no longer exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which does power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.

1
source | link

It can be done, but for most intents and puposes you can safely assume malware cannot directly power on the computer.

Something that is somewhat realistic is the malware also gaining persistence on another device. Say your router has default credentials or a vulnerability, the malware could have spread. Someone could then power on your machine if it had wake-on-lan enabled.

To elaborate, most malware will run in ring 3, and if you're really unlucky in ring 0 as a kernel module or system driver. These are both not running when the system is turned off, and therefore fundamentally cannot exercise control over the machine.

There are however execution modes below ring 0 such as SMM and other firmware, which does power management. However malware abusing this is extremely rare, the only example in the wild I could name is the NSA codename DEITYBOUNCE class malware and the LoJax likely spread by Fancy Bear.

See Forests excellent answer on how this can happen.

https://security.stackexchange.com/a/180107/121894

Do you have info on the malware such as a hash or family name? That would allow for a more detailed answer.