9

Is it possible to determine if the BIOS of a computer has been modified between two points in time from that computer while it's running ?

Effectively I'd like to be able to gather the equivalent of cryptographic hash snapshots of the BIOS (or as much as I can) via the local host operating system (ideally an answer for Linux would be great but any would work) or via something like IPMI without rebooting the computer.

I know there's also an issue of not being able to trust the computer itself but I'm just looking for basic functionality.

Note: I'm not looking to prove that the computer wasn't shipped with an infected BIOS or anything just that no new changes have occurred between something like 1pm and 3pm.

  • Is that for offline dumps only? – m.kin Dec 9 '15 at 2:09
  • 1
    How much do you trust the new BIOS that it does not claim to be the old one? If you don't trust the BIOS itself then there is no way to verify changes or integrity from within the system, because the BIOS is n control and could simply manipulate every input and output. – Steffen Ullrich Dec 9 '15 at 5:52
  • @SteffenUllrich That's what a TPM is for. – forest Oct 16 '18 at 21:03
4

If your board is compatible you should be able to use flashrom with the -r arg to backup the bios to a file. You can then use md5, sha256, etc to grab a hash which can later be compared.

//baseline.sh
//first make your baseline bios checksum with
flashrom -r ./bios.bios
sha256sum bios.bios > bios.checksum

//check.sh
//now periodically check again
flashrom -r ./bios.bios
sha256sum bios.checksum -c
//if your output looks like "bios.bios: FAILED" you have a problem.
  • 2
    Just be aware that if the firmware was modified to be malicious, it can very well be made to intercept I/O requests to the flash chip to return a clean firmware image instead of the real, modified and malicious image. – André Borie Dec 9 '15 at 10:39
  • If he doesn't power cycle the machine the malicious bios should not be resident anywhere. From what I understand the problem you are talking about should only occur post reboot. – Aedazan Dec 10 '15 at 22:13
  • 1
    Installing malicious firmware requires root access, so while the malicious FW may not yet be executed the machine is already compromised and shouldn't be trusted anyway (in this case the compromised kernel will intercept IO to the firmware chip instead of the actual firmware). – André Borie Dec 12 '15 at 16:59
  • Wow, maybe there should be a way to mount the firmware from another machine to check a whole flash of the chip! – jonnyjandles Jan 14 '18 at 11:39
  • 1
    @Aedazan That is not necessarily correct. The BIOS includes the DSDT and other ACPI tables which contain executable AML bytecode. These tables are re-read when certain events happen such as waking from S3 and, I believe, during certain ACPI-driven activities like plugging in an HDMI cable. – forest Feb 20 '18 at 5:34
3

If your system has a TPM you can check its PCRs for any changes between system boots. The first few PCRs are extended with hashes of separate parts of the BIOS, you should look up some documentation and see which PCRs you want to use for your checks. Reading PCRs under Linux is just a matter of reading the correct device nodes under /sys, on Windows it's a bit more complicated and I believe you would need to write custom code for that.

  • Does reading the PCRs hash the parts of the BIOS each time you read them, or only read out the hash which was calculated upon boot? In other words, if you read the PCRs right after boot, then modified the BIOS while the system was running, then read them again, would the values be any different? – forest Apr 24 '16 at 5:07
  • @forest no, the BIOS is hashed at boot and then the PCRs are read-only. However a malicious BIOS could intercept access to the TPM so even if we assume that the BIOS can't interfere with the TPM's measurements there is no guarantee that it can't just pretend to be the TPM itself. – André Borie Apr 24 '16 at 13:59
  • Well a modern Intel TPM actually is in the BIOS, considering it's the Management Engine which acts as the TPM, and the ME firmware is stored in the BIOS. – forest Apr 24 '16 at 23:42
  • 1
    @AndréBorie That is not true at all. It is the CRTM (which is read-only) which sends the BIOS to the TPM, specifically so the BIOS is unable to tamper with the readings. Furthermore, the EK is what guarantees that it cannot pretend to be the TPM, so unless the BIOS vendor has engaged in a large espionage campaign to steal the private signing key from the TCG, it could not impersonate the TPM. – forest Feb 20 '18 at 5:37
  • an offtopic, but i just worry how it turns out that from 550 viewers, only 2-5 people make upvotes to answers. – T.Todua Oct 15 '18 at 12:25
2

Nope.

There are possibilities to read the BIOS & checksum it, but a malicious bios can easily intercept this. So while checking the BIOS checksum and/or TPM maybe show something, an attacker with sufficient knowledge of your security measures can easily circumvent this (and someone having unrestricted access to your hardware will).

However ...

If the PC is online all the time (as verified by i.e. a heartbeat to a second server) you can be pretty sure that the BIOS hasn't been flashed on the hardware side of things. Flashing the BIOS at runtime is probably non-trivial as long as your attacker does not have root access to your server. You will need to be sure enough that the PC was online all the time however (i.e. by specifically seeded heartbeat packages over IPSec and required latency below 10ms).

Note that there is no such thing as 100% secure.

  • An attacker with "sufficient knowledge" cannot circumvent TPM-based BIOS verification unless they can also modify the CRTM, which is typically read-only and cannot be modified. – forest Oct 16 '18 at 21:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.