0

Scenario 1:

  • Attack from Internet, SD-card, USB-stick -->
  • direct reflash BIOS firmware, without the operating system as an intermediate stage -->
  • BIOS firmware or any other firmware which is stored on EEPROM can be replaced with malicious code -->
  • BIOS is infected even after a power cycle

My conclusion then: I can't protect the BIOS/any firmware from being attacked with an operating system that can only read (OS is on a write-protected hardware device like a usb-stick, flash memory), because the operating system is not a "requirement" for the attack

Scenario 2:

  • Attack from Internet, SD-card, USB-stick -->
  • Attack/malicious code doesn't force write operations/events on the operating system -->
  • BIOS firmware or any other firmware which is stored on EEPROM can be replaced with malicious code -->
  • BIOS is infected even after a power cycle

My conclusion then: The operating system is a "requirement" for the attack but I don't need to do or force any write operations/events on the operating system. I can't protect against BIOS attack (nesting malicious code) with a read-only operating system (OS is on a write-protected hardware device like a usb-stick, flash memory).

Scenario 3:

  • Attack from Internet, SD-card, USB-stick -->
  • Attack/malicious code must force write operations/events on the operating system -->
  • BIOS firmware or any other firmware which is stored on EEPROM can't be replaced with malicious code -->
  • BIOS is not infected even after a power cycle

My conclusion then: Read-only OS on hardware write protected device can save the firmware (in this case BIOS) from being attacked.

I always mean the operating system from the victim!

Physical attacks are irrelevant!

closed as unclear what you're asking by Steffen Ullrich, Tobi Nary, Sjoerd, ThoriumBR, forest Sep 9 '18 at 0:18

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I really hope I preserved what you meant. Your question was very, very difficult to understand and to follow. – schroeder Sep 7 '18 at 14:22
  • Hopefully firmware must be signed and flashing requires admin password. This protects against all vectors (and it seems like you do not get that level of protection from most vendors) – eckes Sep 7 '18 at 14:25
2

This won't work. Malware from, say, the Internet can operate solely in RAM, then tamper with the firmware, bypassing the write-protection on the disk.

In fact, this is used frequently because traditional anti-virus solutions only monitor disk writes and reads. By remaining only in RAM, malware can reduce the risk of detection.

More advanced threats will write itself to firmware, where anti-virus doesn't scan, so it can remain on the system while being very difficult to detect. Therefore, the malware will move between firmware and RAM, without writing to disk or being removed if the computer is shut down or the disk is wiped.

See, for example, this Wikipedia article on fileless malware.