3

I am considering upgrading my computer and from what I understand the newer motherboards have soft flashable firmware. This raises the possibility that a hack could infect the firmware on the machine, which could include the UEFI, the memory controller, drive controllers and other hardware components. If this true, then if my machine gets hacked I can't just wipe the drives, I have to throw out the whole machine.

Is this a justifiable fear? Is there anything I do to mitigate it? Are there any modern motherboards that do not have soft flashable firmware components?

Signed Updates Not Reassuring

As far as "signing keys" are concerned they are worthless because it is easy for hackers to get them. For example: http://www.eweek.com/security/sony-left-passwords-code-signing-keys-virtually-unprotected.html. That is just a published example. On the dark net signing keys for many manufacturers are traded like candy.

4
  • It takes quite a bit of work to make malicious firmware, and the work is not easily reusable on other machines, making it not profitable for common malware. Unless you believe you would be targeted by someone who can pay firmware developers full-time for several months to develop such malware, I'd say you're fine. Aug 6, 2016 at 3:02
  • Note that some laptops (I've seen it on Dell Latitide and Lenovo Thinkpads) have an optoin in the firmware menu to verify signatures of further updates, so it'll reject anything no signed by the manufacturer. That doesn't mitigate the risk for everything else, but at least the main firmware is safe. Aug 6, 2016 at 3:04
  • @AndréBorie Oh yeah, the firmware has to be signed, that makes me feel real safe. Aug 6, 2016 at 3:27
  • 2
    @TylerDurden: Do you understand that a digital signature requires the private key which is kept extremely safely and is almost impossible to reproduce? Aug 6, 2016 at 3:59

1 Answer 1

3

The threat depends on who your adversary is and the way the firmware is protected.

Case A: Signed Firmware:

Some people have more resources for example if the threat is from government based malware (who may be able to coerce the manufacturer to hand over signing keys) then it's a more serious threat then if you are concerned about some random malware developer. The threat still exists but on a smaller scale.

Case B: Write Protect Screw:

Some motherboards have a "write-protect" screw that you must remove before the firmware can be adjusted. While this doesn't provide the same type of security it does ensure that you can't be attacked except during a timeframe you know about. That being said you'll have to know Thow to inspect your motherboard for a removed write-protect screw.

On the subject of mitigating an attack:

I would take the advice in the comments and require that all future updates are signed. For past attacks though your best case would be to manually flash a new safe copy of the firmware through another device. (It'd be a nice hands on activity however I'm not able to provide assistance nor instructions on this type of activity as I do not have the experience to do so).

Severity of the threat:

The threat is difficult to remove however it's a very targeted attack and since there are so many different types of computers the attacks have to be extreamly targeted and are out of reach for most malware developers. If a large group got together with a lot of funds they might be able to mass target multiple computer users but it'd be an extreamly expensive attack to pull off and it wouldn't make enough of a payout to justify the initial cost of doing so. It's easier and by far cheaper to mass target a specific vuln and keep attack new users.


Please leave a comment on my answer if you have any questions about my answer and/or need further clarification on anything :)

1
  • 1
    Case B seems pretty secure since it would require physical access to the machine. I don't really consider signing secure because hackers widely trade stolen signing keys for various manufacturers. For example, Sony's signing keys on some their products were virtually public knowledge for a long time. Aug 6, 2016 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .