1

To successfully defend the BIOS from malicious rootkit installation or other malware that writes itself inside BIOS I wonder if these ideas are possible or even done yet:

  • Can you program the BIOS itself in a way that it only accepts data to be written to the BIOS that has been signed with the BIOS-Manufacture's PGP-Key? Basically the same way like normal userland programs get their updates installed.

  • Is it possible to encrypt the whole BIOS data to prevent attackers from just 'upgrading' your BIOS with their malicious code?

In both ways it would be sufficient to protect the BIOS only from write-to-BIOS access. While reading from BIOS doesnt require authorization.

Edit: Is there any way to implement this on your own? Like you secure your HHD with Bitlocker or verify a peer with public key cryptography.

2

You could use UEFI secure boot. 800-147 is all about authenticating firmware updates - it states that BIOS code itself should be protected by a keypair:

To prevent unintended or malicious modification of the system BIOS outside the 
authenticated BIOS update process, the RTU and the system BIOS (excluding configuration 
data used by the system BIOS that is stored in non-volatile memory) shall be protected 
from unintended or malicious modification with a mechanism that cannot be overridden 
outside of an authenticated BIOS update.  The protection mechanism shall itself be 
protected from unauthorized modification. 
  • I do not believe UEFI Secure Boot itself is capable of protecting firmware from modification. You would need to use a TPM for SRTM, or something like Intel BootGuard. – forest Jan 30 '18 at 3:14
1

Intel has implemented a feature called BIOS guard that protects the BIOS from malicious updates in a manner very similar to the first bullet you mentioned. This feature is available starting from Haswell but I am not aware of which computer manufacturers are taking advantage of it yet.

taken from Intel specs for Haswell (4th gen core): Platform Flash Armoring Technology is an augmentation of existing chipset-based BIOS flash protection capabilities targeted to address the increasing malware threat to BIOS flash storage. It protects the BIOS flash from modification without platform manufacturer authorization, helps defend the platform against low-level DOS (denial of service) attacks, and restores BIOS to a known good state after an attack

  • BIOS Guard (PFAT) is obsolete. BootGuard is the preferred modern solution. – forest Jan 30 '18 at 3:15
0

BIOS ROMs used to be write-protected with a physical hardware switch/jumper. It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise. Here's a manual from the good old times.

BIOSes were far less buggy and in need of constant change.

Now factory-installed crapware silently updates the BIOS in the background ... and sometimes makes everything unusable and EFIs with tech like BIOS Guard feel safe on paper but are full of vulnerabilities in practice, while things like Bitlocker, vulnerabilities aside, can actually be useless in some situations. Signatures can be faked.

To conclude, convenience was preferred over safety, as in many other cases. The only true write protect is a hardware write protect and the only true hardware write-protect is a physical system that cannot be activated in any other way (as the fore-mentioned jumper was).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.