5

Assume you are a paranoic that have a 100% open source OS with drivers etc, but you don't have an alternative to your closed source BIOS. How can you sure the BIOS didn't insert malicious code in e.g some programs ? You can't trust a program that computes the hash of the memory, since it may have been tampered with also.

  • Only somewhat related, but check out the ChromeOS verified boot procedure. – tlng05 Jun 25 '16 at 15:10
  • 4
    I have a good and a bad news for you :) ! The good news is that an open sources BIOS exists! The bad news is that now that you have a solution for your BIOS, you can to worry about the multiple other firmwares composing your computer (the classical example are network devices) which basically have got the same abilities as the BIOS during boot time and have no OSS alternative... If I remember rightly, I found this video to be interesting: DEFCON 20: Hardware Backdooring is Practical. – WhiteWinterWolf Jun 25 '16 at 16:02
  • You can't, unless you trust your BIOS. After all, it could silently do just about anything it wants without your OS being able to inspect it. – Natanael Jun 25 '16 at 18:20
2

I have highlighted the key part of your question:

Assume you are a paranoic that have a 100% open source OS with drivers etc, but you don't have an alternative to your closed source BIOS. How can you sure the BIOS didn't insert malicious code in e.g some programs ? You can't trust a program that computes the hash of the memory, since it may have been tampered with also.

If you were able to reverse-engineer your BIOS and prove its capabilities, then you should be able to tell whether it could inject malicious code, etc. This would require a great deal of time and skill, but it might be possible, eventually.

In the meantime, the answer is no: you cannot prove that the OS loaded by your BIOS is the OS you intended.

For related work, see:

  • 1
    For that matter, it requires a great deal of trust to believe that you're running a faithfully-compiled version of the actual code the legitimate author of the project published and that the hardware is executing it as intended. – Stephen Touset Feb 4 '17 at 5:07
  • So don't loan your computer to other people. – FauChristian Feb 4 '17 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.