2

I might be mistaken, but it seems the firmware (UEFI) needs to load some stuff from the disk to be able to do anything really interesting, like loading some advanced tools or loading the OS. Yet firmware infections are often associated with the concept of "persistent infections", where wiping the disk won't help. But what can an infected firmware do on its own, after you have wiped the whole disk? Obviously malicious firmware can load all sorts of malicious stuff, but first it must find that stuff somewhere. Maybe the firmware memory is large enough to contain malicious code to inject somewhere later in the boot process, but I'm not sure there is enough memory available to do anything interesting that actually works.

So what can a malicious firmware after the disk has been totally wiped (every partition has been overwritten) and another clean OS has been installed?

Improve this question
2
  • 3
    Deleting everything on the hard drive doesn't delete the things in the firmware, so it can do everything it could do before you deleted the stuff on the hard drive.
    – Vit
    Commented Apr 2, 2019 at 18:22
  • 1
    Firmware is not just boot. It keeps running after the OS is loaded. It runs at higher privilege level than the OS, the OS or hypervisor can't interfere with it. Intel ME, also firmware, just runs on separate processors in a separate chip on the motherboard, but it has access to RAM and to network. It can do things like scan all RAM periodically to find the Chrome password manager and send all of it over the network to someone.
    – Z.T.
    Commented Apr 2, 2019 at 22:12

1 Answer 1

Reset to default
2

The simpliest malicious firmware can do is to add or replace existing executable files, to make OS load it on boot. This is how LoJack/CompuTrace anti-theft software works.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .