What componets of a PC do firmware viruses and rootkits infect? Secure boot is supposed to protect you from these types of viruses. Although, it doesn't protect you against rootkits in UEFI firmware itself? If so is there anything to protect you from rootkits in UEFI firmware and others what is the best way to protect yourself from firmware viruses?
-
Why should secure boot not prevent UEFI rootkits?– RobertCommented Mar 2, 2022 at 12:37
Add a comment
|
1 Answer
In theory every peripheral with a writable firmware (or one which was compromised from the beginning) can be used for storing malware. Many examples have been described in literature or have been presented at some conference. Some like UEFI/Bios or HDD malware have also been observed in the wild.
Secure boot will in theory prevent some of those (UEFI) but not all. Also Secure Boot has been bypassed several times. Recent example: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Safeguarding-UEFI-Ecosystem-Firmware-Supply-Chain-Is-Hardcoded.pdf
The only real mitigation (assuming a non malicious original firmware) is to know the original/known good state of the firmware and have a way to compare it to the current state. This can be very elaborate or next to impossible for the average person depending on the device. The best protection would be to have the firmware write protected at the cost of making updates more complicated.
-
Good answer. If OP wants to search further, a good term to search is "bare metal cloud platform security" since this issue comes up a lot in that context. Commented Mar 5, 2022 at 23:54