Malware that can survive BIOS re-flashing

Question

The well-respected security consultant Dragos Ruiu is reporting that he has been infected with mysterious malware that can survive re-installation of the OS and re-flashing of the OS. In other words, he has taken an infected machine, wiped it, airgapped it, reflashed its BIOS, replaced its disk drive, installed a fresh OS -- and after booting the new OS, it was still infected.

How might such an infection remain? What mechanisms could malware use, to keep its hooks in a machine and survive both re-flashing of the BIOS and re-installation of OS?

I'm of course interested in possibilities for what mechanism Dragos' mysterious malware might be using, but let's not stop there. More broadly, I'm also interested in what mechanisms malware could use to survive wiping of the disk and flashing of the BIOS. What schemes could malware use for this purpose?

This question has implications for how we recover from infection. A standard saying is that, once you've been hacked, "The only way to be sure is to nuke it from orbit" -- in other words, you gotta wipe the hard drive and re-install everything from scratch. Maybe the lesson from this mysterious malware is that even "nuking it from orbit" isn't enough. So, to understand what we need to do to restore an infected machine to a known-good state, it'd help to understand all of the ways that malware could stay resident even after you replace the hard disk and re-flash the BIOS.

More background: this page summarizes what Dragos has reported about the mysterious malware he was infected with. See also this outstanding answer from Gilles.

Answer 1

As for how it may happen that reflashing the BIOS does not eradicate the malware, we can hazard a few guesses:

• The reflash operation is under control of... the BIOS, so the infected BIOS only pretends to do the reflash (or reinfects the new BIOS immediately afterwards).

• Another flashable firmware in the machine is also infected, and when either it or the BIOS is reflashed, the still infected firmware reinfects the other one. Any device with DMA can hijack the live machine at any point, and most devices with a firmware have an onboard CPU which would be up to the task (GPU, hard disks...).

• The disk firmware is infected, and inserts malicious code in the boot code which reinfects the BIOS. (Not sure it matches the symptoms, but that's a possibility.)

The common theme here is that all the reflashing is done while part of the machine is live, so there is a chicken-and-egg: you cannot securely reflash from a machine which runs infected code (even indirectly, in the case of a DMA-able device with its own CPU), but if the machine is off you cannot reflash either. Ideally, the BIOS chip would be removed from the machine, reflashed from another device (without booting it, of course), and then plugged back. But these chips are usually soldered... We know how to make pluggable chips -- e.g. none other than the CPU, so it is doable without killing I/O performance. But I imagine that soldering is cheaper for the manufacturer.

Maybe manufacturers could add some JTAG-like ports which would allow reflashing a chip soldered in a powered-off board (really powered off, with the power cord physically removed).

Answer 2

Seems completely implausible!

If we assume that the reports are accurate (and I'm uncertain if us observers are qualified to make the assumption that Dragos is being truthful, not mistaken, and not coerced?), then it only leads to three options:

1. The storage media (HDD, SSD, USB drive) are not being completely wiped
2. The BIOS is not being properly flashed
3. Other computer components are being used as a reservoir where the virus lies dormant

I'm happy to accept that #1 is unlikely, at least for magnetic media.

Option #2 may be possible if the flash is being done on the infected system (which may(?) be able to reject the flash and give the illusion of success). Proof of concept has been demonstrated at Black Hat 2013 by Butterworth, Kallenberg, and Kovah [PDF].

Proof of concept of #3 has been demonstrated by Brossard at Black Hat 2012, and is perhaps the most plausible of the already quite rare scenarios above. A quick read of the links provided doesn't appear to show that this angle was considered by Dragos.

Security researcher Jonathan Brossard created a proof-of-concept hardware backdoor called Rakshasa that replaces a computer's BIOS (Basic Input Output System) and can compromise the operating system at boot time without leaving traces on the hard drive.

Brossard, who is CEO and security research engineer at French security company Toucan System, demonstrated how the malware works at the Defcon hacker conference on Saturday, after also presenting it at the Black Hat security conference on Thursday. ... Rakshasa replaces the motherboard BIOS, but can also infect the PCI firmware of other peripheral devices like network cards or CD-ROMs, in order to achieve a high degree of redundancy.

So I suppose the best thing to do for high value targets is to rebuild from known good media onto known good hardware! Not as bad as it sounds, because these days hardware is cheap, especially for said high value targets.

Answer 3

It's unclear from your question if the hard drive content was properly deleted. Re-installing the OS certainly doesn't guarantee that the drive has been wiped out. If the drive was pulled out of the infected computer and replaced or properly wiped out on another machine then it would be plausible to ignore the possibility that malware is still present on it. Firmware and BIOS malware have little use outside of a narrow targetted attack or proof of concepts.

Answer 4

The rookit may reside in ring -2, or the SMM, these infections have been around since at least 2008. This is true despite the downvotes, as is the rest of what is in here. I am told, people here don't like security through obscurity (in reference to the memtest on boot, as seen below)

[update after the dislike] If it is SMM malware, and it survives OS/reinstall, it could be an infected bios or firmware, which you may fix with either a normal flash, or SPI flasher, the former if the virus isn't capable of preventing an update; You should be able to determine if this is the case if your update fails or you see no change in the bios version after the fact. If it is GPU malware, make sure you power down your PC, and maybe even unplug it from the wall, this will clear GPU ram and any GPU resident malware, if it is not embedded in your video cards firmware. Otherwise re-flashing your GPU and or SPI flashing it may be necessary. The same goes for hard drive firmware as well. If the harddrive's chipset was infected, likely via jtag, you will likely need to replace the drive itself, research into this is ongoing. If it is NIC card malware embedded in the firmware, you may have to re-flash that as well, or disable your onboard NIC in the BIOS and buy a OTP flashed NIC (One time flash), which is flashed once on the assembly line and does not allow for future re-flashing. Just to save you the headache, The RTL8111G/RTL8111GS features embedded One-Time-Programmable (OTP) memory. Like the UGreen Gigabit Ethernet PCI Express PCI-E Network Controller RJ45 Adapter link

If your motherboard itself or any of its components have malware embedded directly on the chips from some point between the manufacturing process and landing in your residence, you may have to remove each piece of hardware one at a time and test until you determine which component is causing the problem... if it is on your motherboard itself, you may have to buy a new motherboard.

One thing I would suggest is you wipe your ram on boot through bios with the extended memory test, memtest or "slow boot" option, this zeros the ram by writing to every sector, similar to memtest86x, but it happens right on post and with typically only one sweep. It may also clear data malware has injected into ram during the post, from an infected firmware module or chipset, however unlikely this scenario may be, and may allow you to complete functions if they were are blocked by malware.