1

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants.

Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS uses for communication (some type of side-channel attack using sound waves) has already been PoCed.

What I really don't understand and couldn't find any related answers in the paper or anywhere else is:

Assertion 38: badBIOS reflashes the system BIOS and is able to persist after the machine has been re-flashed with legitimate firmware.

I can think of one case this could be true; reflashing the SPI chip from the infected host OS.

Otherwise, did he really claim that even if you desolder the chip from the motherboard, attach it to a non-badBIOS'd SPI programmer you would not be able to reflash or read the actual badBIOS .bin image? Is it even theoretically possible that a chip could 'fool' you about its actual content if it is not connected to the host motherboard?

2 Answers 2

3

Otherwise, did he really claim that even if you desolder the chip from the motherboard, attach it to a non-badBIOS'd SPI programmer you would not be able to reflash or read the actual badBIOS .bin image?

The claim being referenced here, in its entirety, was:

We've already found some persistent BIOS malware that survives re-flashing with it.

(source)

This is short enough to be subject to a bit of interpretation, but Vafa's interpretation seems to be consistent with the original wording, as well as with the other claims made by Dragos Ruiu.

Is it even theoretically possible that a chip could 'fool' you about its actual content if it is not connected to the host motherboard?

Not a serial flash chip of the type typically used for BIOS storage, no. These parts are purely used for storage -- they don't contain anything recognizable as a CPU, and cannot be reconfigured in the way implied here.

More complex storage devices (like SSDs) could theoretically be reconfigured to hide data in slack storage space, but this isn't such a device.

0

Disclaimer. There is no proof that BadBIOS is real yet.

Removing the bios chip, and putting it in a SPI programmer would allow it to be reflashed. I'm pretty sure he didn't claim that could be blocked. But fairly often, the bios chip is simply not that easy to remove anymore. To reflash it you would have to boot something with the motherboard, and the motherboard's theoretical bios rootkit can intercept it, and trojan the flasher.

The trick BadBIOS supposedly did was prevent booting from any device it couldn't infect, like a cd-rom drive. That was the big tell.

If you attempted to boot to a secure flashing environment, if it was a read only device, the boot would be blocked, forcing you to use something it could exploit.

You use a usb flash drive? One with write protect? it still infects the firmware to install it's stealth and reflash protection. Cryptographically secure usb flash drive? it turns into a paperweight because the firmware modification is caught.

That was supposedly how it worked. The infections kept jumping to usb firmware, hard drive firmware, and bios firmware. and if they all aren't removed at the same time, each one reinstalls all the others. And with the difficulty of removing the bios chip on a modern motherboard, you pretty much have to trash the motherboard, and reflash everything else with a clean system.

You actually manage to flash the bios. did you get the boot drive's firmware too? If not, it's back inside the BIOS once you boot again.

This truly terrifying level of persistence is indeed possible. USB devices can be trojaned to detect when they are booted with, and modify their contents on the fly. The BadUSB team did a POC where a flash drive will trojan the Ubuntu installation files that are on it, but only when it's booted from. You could copy the files to the drive, and verify them with every hash and it would pass, but when you actually booted it, it would trojan the installers security, as well as place the backdoor in.

No verified BadUSB attack that's truly invisible that works on an already running PC has been verified yet that i know of. the keyboard trickery requires that you not be watching the screen and an unlocked PC. The ethernet card trickery requires that you visit the site its' replacing for you. But presumably this is what BadBIOS did. Silent infection of USB peripherals is possible, and conditionally modifying files on the usb itself is also possible, which can silently infect installs from said usb stick. but that's not quite enough to do what BadBIOS supposedly does just by plugging in an infected USB stick.

5
  • You don't have to thrash the motherboard, there are connectors that can connect to the chip on the board pretty easily. They are called micro-grabbers or test clips, and they are easy to use.
    – ThoriumBR
    Dec 21, 2023 at 21:34
  • I think if it was always that easy, he would have been able to disinfect something. I do remember older motherboards with socketed bios chips you could just pull easily. I was not sure there was a reliable method that worked on all modern motherboards. Dec 22, 2023 at 22:29
  • I don't know, some of this seems to be really far-fetched. Yeah, there are of course dangers lurking in the firmware, but this kind of malware is EXTREMELY rare, since it could get dumped and reused, and that's what since the Vault Leaks has been tried to be avoided at all costs. Also, how likely is it for parts infecting other parts of the PC? Please provide sources for your speculations. Dec 22, 2023 at 22:32
  • i never said it definitely happened. But it is confirmed that grayfish/equationdrug/IRATEMONK could reprogram many hard drive firmwares, allowing it to survive a nuke and reinstall itself regardless of operating system, and that it knew fat, ntfs, ext3 and UFS, so it could tailor payloads for all. Which could easily restore anything that hid in the bios. I was trying to go over what could be plausible. Dec 22, 2023 at 22:55
  • @Mr.Beeblebrox look on youtube how to reflash a bricked motherboard, it's trivial. This one shows how to use a clamp to flash a BIOS from a disconnected motherboard.
    – ThoriumBR
    Dec 23, 2023 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .