4

I am concerned about the threat of persistent malware entrenched in device firmware. I am not familiar with the intricacies of firmware security, so I am turning to SE for help.

I recently learned of FSF-certified laptops that have all proprietary firmware removed, and come with open-source firmware, bios, and operating system. For example, the Taurinus X200.

My question is whether such a laptop provides greater protection against firmware malware, such as BadBIOS? Are there mitigations that open-firmware laptops have that proprietary-firmware laptops do not, such as an ability to inspect the firmware for changes, or perhaps the ability to re-load the firmware on a regular basis? Are there other aspects of open firmware that one needs to bear in mind? Thanks in advance for any insight!

  • There's also the possibility of vulnerabilities in the firmware. Open source doesn't really protect against that (consider ShellShock in OpenSSL). – Neil Smithline Oct 16 '15 at 18:10
  • @Neil HeartBleed was OpenSSL, ShellShock was bash. And goto-fail was Apple SecureTransport, also open source. – dave_thompson_085 Oct 17 '15 at 1:50
  • Agreed: all software will have bugs (some of those bugs being vulnerabilities), and being open source is not a panacea. My question is focused on whether the open source nature of the example BIOS enables technical mitigations to firmware malware that are not available to proprietary BIOS firmware. – taltman Jan 11 '17 at 7:28
0

I think Ken Thompson nailed this problem in Reflections on Trusting Trust paper.

You can't trust code that you did not totally create yourself. No amount of source-level verification or scrutiny will protect you from using untrusted code.

Thus the only thing we can do is to enumerate possible threats in our threat model and place a nominal level of trust at a particular level of depth.


My question is whether such a laptop provides greater protection against firmware malware, such as BadBIOS?

There is no silver bullet answer to this question, however in general you should be looking for laptops that offer trusted boot chains. Features like Microsoft's Secure Boot, a hardware TPM, OS with TPM support, etc. are the closest you'll get to real world commercial level mitigations against BadBIOS and other attack variants.

Are there mitigations that open-firmware laptops have that proprietary-firmware laptops do not, such as an ability to inspect the firmware for changes, or perhaps the ability to re-load the firmware on a regular basis?

It isn't OSS specific, but again relying on a laptop's TPM to provide a level of trust is the general approach you should look for here.

  • Agreed that there's some point where you have to trust the stack. What has me concerned is that people have reported these nefarious persistent firmware infections, but there hasn't been much said about how to mitigate these attacks. Can you provide links to the trusted boot chain mitigation approach that you advocate? Otherwise, ready to accept your answer. – taltman Jan 11 '17 at 7:30
  • This is implementation specific, but here's how Windows 8.1 boot process works. – breadtk Jan 20 '17 at 21:08
1

No, open-source firmware does not provide "greater protection against firmware malware" just because it's "open". It can still have the same vulnerabilities as the closed-source firmware (see e.g. BARing the System: New Vulnerabilities in Coreboot & UEFI based Systems).

It does lessen your chance of infection significantly just because your firmware is not of a common variety and not a part of monoculture of the few BIOS makers (see How Many Million BIOSes Would you Like to Infect? for background on the issue), in the same way as using Mac or Linux makes you immune from Windows viruses (but Mac and Linux viruses do exist).

However, open-source firmware may implement additional protections which make it more resilient against infections. For example, Chromebooks use signed firmware and almost any modifications of it will make machine unbootable (unless you enable developer mode which requires physical access). Note that the same feature is offered by the recent Intel BootGuard (except it does not have developer mode - once enabled, the signing checks can't be removed).

P.S. Please note that BadBIOS has not been confirmed to be real. There were a few proof-of-concept rootkits presented by researchers and there was some stuff in the leaked Equation Group files which targeted BIOSes of some network appliances but AFAIK the only confirmed in-the-wild BIOS infection was Mebromi which only targets pretty old Award BIOS versions. I would suggest you to think about your threat model and concentrate on the more realistic threats first (e.g. phishing/social engineering).

0

Yes, the Libiquity Taurinus X200 is a great way (there are others that claim open firmware but Libiquity appears the most-complete in late 2016) to provide transparency via open firmware. If you want to perform a secure code review, well, the code is open-source so you can just go read the code.

If you want to test those properties, I suggest you learn how to build the code through static analyzers as well as check out the work here -- https://github.com/chipsec/chipsec

  • The open firmware (for various definitions of open) can ensure a clean bios is installed, via static analyzers as you state. But how does it mitigate firmware malware, like BadBIOS? – taltman Jan 11 '17 at 7:17
  • Check out a more-complete open firmware architecture, such as Heads. The FAQ explains interaction with various firmware malware -- trmm.net/Heads_FAQ – atdre Jan 11 '17 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.