3

Let's assume that a hacker knows the BIOS password of a computer, but can only connect to the computer over a network (Internet). The attacker has no physical access to the computer.

Is knowing the BIOS password of any advantage to him/her, in any way?

  • 2
    No. But you should consider the probability of password reuse for other logins. – Tom K. Nov 24 '18 at 16:26
3

Usually not, but I can imagine some edge cases where it might matter.

As another comment mentions, some vendors provide interfaces all the way into userspace (reachable by normal programs and malware) to edit the bios config, those can be secured with a password.

Other answer:

The only way to interact with the BIOS in order to use the password is to be physically at the computer.

I would argue that the only way to interact is through a HID. But to interact with an existing HID (or even emulate a new one) you don't need to be physically anywhere near it. See keystroke injection in wireless keyboards: https://github.com/BastilleResearch/mousejack

A few Asus motherboards support cold boot from ps2, with usb to ps2 adapters still being used or Wake on Lan this becomes a practical remote attack. You could get a machine out of a powered-down state, and blindly enter the bios because of the predictable timing at boot.

Access to the BIOS could then be a way to set the system to boot from the network, bypassing the security model of the OS.

A properly used BIOS password would probably prevent that.

2

The BIOS password alone isn't generally sufficient to be much of a concern. However, some servers have out-of-band management options that can get you BIOS access over a network(iLO for HP for example). If that isn't secured or the attacker has already compromised it, then having a BIOS password would be one more barrier to overcome.

-1

The only way to interact with the BIOS in order to use the password is to be physically at the computer.

  • 2
    It’s worth considering remote interfaces like Dell iDrac or HP ILO. Both vendors also have BIOS tools which can be used from the command line and may need the password. – David Nov 23 '18 at 23:35
  • @David when I was using iDrac and ILO, the BIOS password was different from these tools – schroeder Nov 24 '18 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.