2

Everybody knows about the dangers of Rootkits / BIOS malware. What do you say about this countermeasure?

In order to actually get infected the malware needs to use the OS to 'patch' the BIOS chip.

Now consider running Linux OS.

  • What package / tool in OS is responsible for patching / updating / upgrading / writing to the BIOS chip?

  • Is it possible to remove these packages in order to prevent any malware from writing to any BIOS hardware?

  • Is it furthermore possible to hardcode a rule inside your OS that prevents any change to any BIOS software with no exceptions whatsoever? Even if the malware reaches the targeted system and manages to install these missing 'tools' mentioned above, it wouldn't work out, because the write link to BIOS hardware is forbidden in Kernel code?

Improve this question
2
  • Rootkits and BIOS malware are two different things, though there is some overlap. Are you interested in rootkits, or purely BIOS malware? On a side note, BIOS malware is incredibly specific and so rare that you probably don't have to worry about it too much.
    – Chris Murray
    Commented Sep 15, 2014 at 15:30
  • @ChrisMurray I'm interessted in malware that is persistant and resistant against HHD change. Malware that is (nearly) undetectable, because it is stored in BIOS chip! Why not hardcode in Kernel of OS, that all write access to BIOS chip is prohibbited to all users and machines?? I will never need to update / change my BIOS software.
    – user3200534
    Commented Sep 15, 2014 at 16:42

1 Answer 1

Reset to default
2

The problem is that the early developers of the BIOS malware already thought of the potential for the necessary drivers not being available, so they included them.

If you can write a rule to prevent something, then you can interact with the rule and disable it, so that's not an option either.

The primary defence is not to allow kernel mode access to the malware. You do this by limiting the access of any executable (i.e. not root).

Anti-malware software often include a wrapper for the BIOS writing processes and prevent unauthorized use.

The combination of restricted access and wrapped processes are the better methods then what you suggest.

Improve this answer
3
  • Why not completely block all write access to BIOS from any user (also root)? To make BIOS flashing (good or bad) impossible with this OS running. What OS do implement this already?
    – user3200534
    Commented Sep 14, 2014 at 20:10
  • 1
    The BIOS needs to be able to be flashed, an OS is the means to do that. You would either have to write an OS that lacked access to the BIOS, which would break the OS, or create a BIOS that could not be updated.
    – schroeder ♦
    Commented Sep 14, 2014 at 20:15
  • Some computers (for example my Dell one) has an option in its BIOS named "Signed firmware update", that I think requires the firmware (BIOS) image to be signed for it to install successfully. I'm not sure if that's completely secure or not but that's at least better than no security at all.
    – user42178
    Commented Sep 15, 2014 at 0:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .