0

I haven't really understood whether firmware level infection (on either motherboard or drives) can actually be a thing without physical access, however how can one factory reset the firmware in that case?

Is there, in particular, a way to be sure it was reset to a clean version, without interference from a malicious edited firmware? Do motherboards have some sort of uneditable, ROM-stored version you can fall back to? It seems so lame if editable firmwares in motherboard simply created new security risks...

|improve this question
  • 1
    I don't have time to answer right now, and I think this is a dupe anyway, but the answer is pretty much that you'd need to use hardware (an SPI programmer) to physically reflash the firmware chip. And no, they do not typically come with a backup version in ROM. And firmware-level infection is possible without physical access (the only reason the reverse isn't true is because the malicious firmware could prevent itself from being reflashed, unless hardware is used). – forest Oct 31 '18 at 3:48
  • Could you elaborate a bit on the last sentence? What is the opposite which isn't true? – Eärendil Baggins Oct 31 '18 at 4:04
  • Also what do you mean with "flashing the bios with hardware"? Is it enough to use the motherboard's built-in BIOS flashing tool? – Eärendil Baggins Oct 31 '18 at 4:10
  • Usually, the motherboard's built-in flashing tool is controlled by the BIOS itself, so a compromised BIOS would also result in a compromised flashing tool. – forest Nov 1 '18 at 6:58
3

I haven't really understood whether firmware level infection (on either motherboard or drives) can actually be a thing without physical access

It's possible because you can update the firmware on many boards without actually needing physical access. The common case is to use the EFI Capsule Loader interface, but there are other methods out there too, one of the scariest being the use of Intel AMT to reflash firmware remotely with zero interaction from the user (there are actually systems that can do this).

however how can one factory reset the firmware in that case?

Any method of doing it with the system powered up requires cooperation from the firmware itself, and it's pretty trivial for the malware to just not cooperate (in fact, it's actually easier for them to not cooperate than it would be for them to cooperate). As a result, you need to physically remove the flash memory chip that contains the firmware, and then manually reprogram it using specialized hardware (well, specialized from a typical end-user perspective, you can use pretty much any SPI flash programer you want as long as it has the right interface). DOing that is going to be functionally impossible for most people, mostly because it's nearly impossible to get the raw firmware image out of the update packages from the vendor (the hardware to actually program it is cheap, and it's not something that takes more than some really basic skills to use).

Is there, in particular, a way to be sure it was reset to a clean version, without interference from a malicious edited firmware?

Verifying the firmware image you're going to use is sufficient, provided you actually reprogram it correctly.

Do motherboards have some sort of uneditable, ROM-stored version you can fall back to?

As a general rule, no, it would be wasted space and power for 99.9% of end users, and would also be a logistical nightmare for the support staff.

Many good motherboards do, however, use transactional updates and have a backup copy of the firmware (it starts as the same version, and then after the first firmware update it tracks the last used version. This doesn't really help though because anything that can rewrite one can just rewrite both.

It seems so lame if editable firmwares in motherboard simply created new security risks...

Updatable firmware is not something new. The concept has been around for far longer than most people realized (the oldest PC's I've seen that could do it without needing programming hardware or a manual chip swap are from over a decade ago). It's only recently that it's become really widespread though because UEFI makes it much easier for the OEM to provide support for it.

|improve this answer
  • HP's corporate computers have had an uneditable firmware backup since 2014 (HP Sure Start) and it reduces support issues by recovering automatically, instead of halting the system when the signatures don't verify. Apple has done something similar with their T2 chip. – user71659 Oct 31 '18 at 23:49
  • yeah, support with things like "download latest firmware version from the internet". No need to even boot into the OS. 10-15 years ago you had to use a floppy, pray that it was formatted properly (improper could brick the board), and also hope you'd selected firmware for the correct board (see previous)! Most people never bothered to update motherboard firmware, if they even knew they could. – Clockwork-Muse Oct 31 '18 at 23:50
  • I wonder if there are any techniques for firmware malware to detect and intercept flash attempts from software that work on a broad spectrum of hardware and operating systems. For example, would it be possible for BIOS malware to create an SMI trigger on writes over SPI? – forest Nov 1 '18 at 7:57
  • Is the image you download from the vendor's website for update via the motherboard's flashing tool fine for flash programming with SPI? Also how can one verify if his system is vulnerable to a remote firmware rewrite? – Eärendil Baggins Nov 1 '18 at 12:18
  • @EärendilBaggins Generally no. In addition to the actual data, it contains metadata used by the official firmware update tools, and usually some form of cryptographic signature to verify the image. It is technically possible to decapsulate that data, but it's nontrivial to do because the formats are (intentionally) not publicly documented. – Austin Hemmelgarn Nov 1 '18 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.