Everybody knows about the dangers of Rootkits / BIOS malware. What do you say about this countermeasure?
In order to actually get infected the malware needs to use the OS to 'patch' the BIOS chip.
Now consider running Linux OS.
What package / tool in OS is responsible for patching / updating / upgrading / writing to the BIOS chip?
Is it possible to remove these packages in order to prevent any malware from writing to any BIOS hardware?
Is it furthermore possible to hardcode a rule inside your OS that prevents any change to any BIOS software with no exceptions whatsoever? Even if the malware reaches the targeted system and manages to install these missing 'tools' mentioned above, it wouldn't work out, because the write link to BIOS hardware is forbidden in Kernel code?