1

Is it possible that somebody who has access to my laptop can flash a new version of bios which does spying too i.e. recording keylogs, url browsed, downloaded files etc and send it to remote location and i will not even come to know about it ? I am running ubuntu 13.10 on dell inspiron.

  • Is this hypothetical or do you have cause for concern? If so perhaps you could relate those details. All things are possible given enough time and money. "Is is likely" might be a better focus... – zedman9991 Feb 4 '14 at 14:35
  • the point is when the bios is upgraded or reinstalled/flashed , does the user observe any change ? is OS, ubuntu here, has to be reinstalled ? – rks Feb 4 '14 at 14:39
  • If it does not wipe out necessary settings then you won't notice anything. Btw why do you think, that the old bios version did not contain spyware already? (Given a paranoid scenario) – Samuel Feb 4 '14 at 14:56
  • spyware at the level of dell does not bother me much, what affects me is the spyware introduced by some known person. so flashing bios does not removes OS ? – rks Feb 4 '14 at 15:17
2

What you're referring to is theoretically possible (i.e. malware which replaces your computers BIOS keeping it's operation intact but adding malicious functionality), but it is very non-trivial to pull off this kind of attack.

The attacker would need to be targeting you specifically as there's really no such thing as a general BIOS that they could place onto the machine. So they would need to custom craft something for your specific model of laptop, then likely get physical access to it to install it.

That said, done correctly this attack would likely not be detectable by standard user tools, although in depth forensics should be able to notice the difference between a standard BIOS and the one installed on your machine.

If you're interested in reading more on the difficulties and possibilities of this kind of attack lookup "BadBIOS" on your favourite search engine.

  • Are such customized BIOS available for free or after payment ? People whom i suspect are not experts but they may download/buy stuff and install. – rks Feb 4 '14 at 19:06
  • I'm not aware of anywhere where that kind of malware is available but not really my field. As I said it's a very specialised piece of software, not something you'd really download off the shelf! – Rory McCune Feb 4 '14 at 19:37
  • No such thing as a general BIOS? I think cr4sh wants to have a word with you... Yes, it's not trivial, but I would absolutely not call it very non-trivial. It's fairly simple when it you get down to it. Also, BadBIOS is so overhyped as to be a downright hoax. No such infections have ever been found in the wild, and even if they had been, it only allows communication between two already infected systems for contrived reasons using a not-at-all novel covert medium. – forest Jun 8 '18 at 6:35
  • @forest y'all are aware this answer is from 4 years ago, and much has changed since then, right? – Rory McCune Jun 8 '18 at 7:42
  • @RоryMcCune The same was equally true 4 years ago. UEFI bootkits have been fairly easy to develop (for anyone who does UEFI development) essentially since UEFI came out. True, extremely hardware-specific BIOSes have not existed for well over a decade. Nowadays really the only hardware-specific parts are a few platform configuration tweaks here and there. – forest Jun 8 '18 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.