0

For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare. I was wondering if there is any way to do the same with the bios and bootloader and check their integrity manually. Can you for example create an image file of the bootloader and/or bios and get their sha256 value?

Or perhaps there is some other similar method?

Improve this question
5
  • "For any file on your OS you can get a md5 or sha256 value and if you suspect anything you get it again and compare." - if you OS is compromised you cannot trust anything reported by the OS anymore. Specifically you cannot be sure that the hash reported is actually the hash of the file you asked for instead of the hash for some hidden shadow copy of the original file and that the visible file is compromised.
    – Steffen Ullrich
    Commented Aug 6, 2022 at 4:59
  • @Steffen: If it is possible to create a bios image then you could store it and check its integrity with another computer.
    – User4857
    Commented Aug 6, 2022 at 5:09
  • Again, you cannot create something trustable from inside a potentially compromised system, since the system can simply lie to you. If the bios is compromised you need to hash the image without the bios somehow being involved, i.e. before it is executed. That's what secure boot is doing. Why do you want something different?
    – Steffen Ullrich
    Commented Aug 6, 2022 at 5:17
  • @forest:That question is about how TPM performs integrity checks. It asks for the technical details. My question is whether you could do this manually. RibaldEddie has answered how you can check the integrity of the bios. But you said that doesn't cover the entire boot chain. So part of my question has been answered.
    – User4857
    Commented Aug 9, 2022 at 7:52
  • @User4857 Ah, I missed the "besides TPM" part.
    – forest
    Commented Aug 9, 2022 at 8:01

1 Answer 1

Reset to default
-1

Yes in theory you can do this, however it requires a computer system that is known-good; that is, you can trust the accuracy of what it reports when you hash data on it.

You also require some hardware tools and a little bit of skill / practice.

What you can do is locate the chip on your device's mainboard in which the bios / efi is stored and read the data inside the chip. Many of these EEPROM flash chips have an SPI interface to the motherboard, so you can get a simple SPI chip reader to pull the data out of the chip without having to desolder it.

Once you've made a copy of the data in the flash chip on a known-good computer, you can examine the data and compare it to a known-good image of the flash data. Usually you download that data from the computer manufacturer. For example, Apple includes firmware images in their software updates. Traditional mainboard manufacturers offer the bios image for download on their web site.

I'm glossing over some details here for the purpose of brevity. There are things that make this a bit more complex than I've made out here, but in general the workflow will do what you want.

Improve this answer
12
  • If you mean, is there something other than secure boot that can verify the integrity of a running computer from within that computer, the answer is no. If you don't have a tamper-proof cryptographic root of trust, the system cannot be secure. In theory you could read all the memory of the running system with a probe and determine its behaviour, but in practice you cannot.
    – RibaldEddie
    Commented Aug 8, 2022 at 4:35
  • This isn't correct. You could still have a malicious option ROM that could modify the BIOS after you've verified the contents of the EEPROM and booted up, and the technique you describe would not protect from that. That's why you need something like measured boot to verify the entirety of the boot chain.
    – forest
    Commented Aug 8, 2022 at 23:15
  • @forest I’m not really sure we disagree — the technique I mentioned is to determine the existence of a permanent implant in one specific chip. If you had, say, a thunderbolt device with an option ROM that modified the BIOS at boot time, then you would not be able to determine that without also analyzing the ROM in all devices that have privileged access to the system. That having been said, even with a secure boot, a malicious peripheral might be able to attack a running system unless EVERY component with privilege is also cryptographically verified.
    – RibaldEddie
    Commented Aug 8, 2022 at 23:33
  • Measured boot an Secure Boot are unrelated. The reason I disagree is because you could not check the integrity of firmware manually by only looking at the BIOS/UEFI chip on the mainboard. I think it would be better if you edited your answer to specify that there are many components that would have to be verified, not just "the chip on your device's mainboard in which the bios / efi is stored".
    – forest
    Commented Aug 8, 2022 at 23:37
  • Measured boot is not a reliable method of running known-good code. Instead it’s a mechanism to measure the hash of what was booted. They are related insofar as they both rely on a TPM but I wouldn’t rely on measured boot for much, since malicious software could in theory lie about what was booted. The only way to be certain is to read the firmware from the chips themselves.
    – RibaldEddie
    Commented Aug 9, 2022 at 2:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .