1

To successfully defend the BIOS from malicious rootkit installation or other malware that writes itself inside BIOS I wonder if these ideas are possible or even done yet:

  • Can you program the BIOS itself in a way that it only accepts data to be written to the BIOS that has been signed with the BIOS-Manufacture's PGP-Key? Basically the same way like normal userland programs get their updates installed.

  • Is it possible to encrypt the whole BIOS data to prevent attackers from just 'upgrading' your BIOS with their malicious code?

In both ways it would be sufficient to protect the BIOS only from write-to-BIOS access. While reading from BIOS doesnt require authorization.

Edit: Is there any way to implement this on your own? Like you secure your HHD with Bitlocker or verify a peer with public key cryptography.

Improve this question

3 Answers 3

Reset to default
2

You could use UEFI secure boot. 800-147 is all about authenticating firmware updates - it states that BIOS code itself should be protected by a keypair:

To prevent unintended or malicious modification of the system BIOS outside the 
authenticated BIOS update process, the RTU and the system BIOS (excluding configuration 
data used by the system BIOS that is stored in non-volatile memory) shall be protected 
from unintended or malicious modification with a mechanism that cannot be overridden 
outside of an authenticated BIOS update.  The protection mechanism shall itself be 
protected from unauthorized modification.
Improve this answer
1
  • I do not believe UEFI Secure Boot itself is capable of protecting firmware from modification. You would need to use a TPM for SRTM, or something like Intel BootGuard.
    – forest
    Jan 30, 2018 at 3:14
1

Intel has implemented a feature called BIOS guard that protects the BIOS from malicious updates in a manner very similar to the first bullet you mentioned. This feature is available starting from Haswell but I am not aware of which computer manufacturers are taking advantage of it yet.

taken from Intel specs for Haswell (4th gen core): Platform Flash Armoring Technology is an augmentation of existing chipset-based BIOS flash protection capabilities targeted to address the increasing malware threat to BIOS flash storage. It protects the BIOS flash from modification without platform manufacturer authorization, helps defend the platform against low-level DOS (denial of service) attacks, and restores BIOS to a known good state after an attack

Improve this answer
1
  • BIOS Guard (PFAT) is obsolete. BootGuard is the preferred modern solution.
    – forest
    Jan 30, 2018 at 3:15
0

BIOS ROMs used to be write-protected with a physical hardware switch/jumper. It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise. Here's a manual from the good old times.

BIOSes were far less buggy and in need of constant change.

Now factory-installed crapware silently updates the BIOS in the background ... and sometimes makes everything unusable and EFIs with tech like BIOS Guard feel safe on paper but are full of vulnerabilities in practice, while things like Bitlocker, vulnerabilities aside, can actually be useless in some situations. Signatures can be faked.

To conclude, convenience was preferred over safety, as in many other cases. The only true write protect is a hardware write protect and the only true hardware write-protect is a physical system that cannot be activated in any other way (as the fore-mentioned jumper was).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .