6

http://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface#Security_Risk

Ubuntu Linux founder Mark Shuttleworth has likened ACPI to Trojan horses.[28] He has described proprietary firmware (firmware ACPI or any other firmware) as a security risk, saying that "firmware on your device is the NSA's best friend" and calling firmware (ACPI or non-ACPI) a Trojan horse of monumental proportions". He has pointed out that low quality, closed source firmware is a major threat to system security:[7] "Your biggest mistake is to assume that the NSA is the only institution abusing this position of trust — in fact, it's reasonable to assume that all firmware is a cesspool of insecurity, courtesy of incompetence of the highest degree from manufacturers, and competence of the highest degree from a very wide range of such agencies".

As a solution to this problem, he has called for declarative firmware (ACPI or non-ACPI).[7] Firmware should be open-source so that the code can be checked and verified. Firmware should be declarative, meaning that it should describe "hardware linkage and dependencies" and should not include executable code.

Is there anyway to properly protect yourself from backdoors in the ACPI or in general?

Can firmware be infected or injected with backdoors or trojans very easily?

6

Firmware is code. It executes on the CPU on behalf of some hardware device; or it executes on the device directly.

In general, if your own hardware is intent on spying on you, then you lose. A more worrying development is that many pieces of hardware (e.g. keyboards) contain a completely honest firmware that is upgradeable, and some malware has been spotted in the wild which replaces some firmwares (using the "upgradeable" feature) with malicious code.

The biggest firmware of all is called the BIOS; it is the code which runs first when the computer boots up, before the operating system is loaded (and, indeed, the BIOS is responsible for loading the OS). Malware installed in the BIOS itself resists, by definition, complete reformat-and-reinstall of the operating system. The CIH virus, better known as "Chernobyl virus", was already muddling with the BIOS back in 1998 (but it was doing so rather inexpertly, resulting in a mangled BIOS, not a stealthily infected BIOS). More recent virus will install in a non-destructive way, and persist.

The BIOS is not the only piece of reflashable firmware in a computer, so the possibilities are large.

To write a firmware-installable virus, you need to do some reverse-engineering on the hardware and firmware format. It seems that attackers do that. Open-source firmwares would technically make such reverse-engineering easier, but would also help the "defenders" who look for security vulnerabilities that they can fix. It is the classical Open-source / closed-source security debate which has been ongoing for quite some time and has not reached any sort of definitive conclusion yet.

The call for "declarative-only firmware" is a bit misguided, though. The idea is that no piece of hardware should come with specific code to be executed on the CPU; instead, such code should be in the operating system driver. This fails to take into account the whole situation, in two main ways:

  • A machine must be able to boot up in order to actually load the OS and the drivers, so there must still be some firmware somewhere (namely, the BIOS) who knows how to access the hard disk.

  • Many peripheral devices have their own CPU. This includes of course GPU, but all network interfaces, keyboards... and, for them, it makes no real sense to call for a "declarative-only firmware" since the code is meant for the device CPU anyway, not for the main CPU, and the OS never sees it. A keylogger inserted into the firmware for an Apple keyboard has been demonstrated.


Generic workarounds:

  • Work only with hardware from "trustworthy sources" with strict internal security procedures (in particular background checks on employees) so that chances are that the firmware is initially clean and honest.

  • Make it so that firmware is not reflashable. There again, this depends on the hardware. For instance, for some motherboards, the BIOS cannot be reflashed unless a specific jumper is physically set; otherwise, the needed reflashing current simply cannot reach the chip.

Since a lot of existing hardware with reflashable firmware cannot be made non-reflashable, and "trustworthy sources" are a rarity from the point of view of any nation (because parts come from different countries), it follows that these generic workarounds are not actually practical.

(Maybe China could come up with a "100% Chinese computer" but having all parts produced on your national territory is not the same as being able to trust in their honesty and reliability.)

  • 1
    What if the hardware manufacturers started open sourcing their firmware code and allowed users to compile and reflash their hardware from source code, then flip a physical switch to prevent further reflashing? That would be a good way to eliminate potential for hardware backdoors (especially from NSA) if users can audit and verify the firmware code to be trustworthy. – NDF1 Jun 24 '14 at 21:49
  • As a continuation of the threats given by firmware of all sorts, be prepared for all hard drives to be totally untrustworthy. The Equation Group hard drive firmware APT renders drive wiping to be easily applied soul salve that does nothing. Waiting for when it becomes a general production for all other malware. Rootkits will be a thing of the past, rooted firmware rules. – Fiasco Labs Feb 17 '15 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.