Explain how a BIOS/UEFI infection may compromise the security of the Operating System.
Compromising the security of the Operating System through infecting the BIOS/UEFI is easier said than done though it really exists and a few samples have been seen in the wild. Taking control of the BIOS/UEFI allows the enemy to manipulate the boot sequence of the computer and end up with running malware or using built-in windows code to transmit C2(Command and Control) communications to the attacker's server and download more malware/modules or do certain actions like copying/sending data, open firewall ports, turn off the firewall, and well practically anything since any enthusiastic attacker like that would definitely aim to get kernel-level privileges or in windows terms, SYSTEM level privileges.
TLDR; Think of it like this: Your computer is a 5 storey building with the following floors:
- 1st Floor - BIOS/UEFI
- 2nd Floor - Bootloader
- 3rd Floor - EFI Partition Program
- 4th Floor - Operating System
- 5th Floor - User Applications
I'm sure you agree that destroying the 1st floor technically destroys the whole building already.