4

There are very few hardened Operating Systems who restrict or totally disable Terminal 'root' access for the user.

  1. Would this feature prevent persistent BIOS rootkits from writing into BIOS or infecting other firmware on the machine? What's the security margin of this feature?

  2. Considering above attack vectors, would it make a difference either totally disabling root access (hardcoded) or just use a strong root password? What's safer?

  3. Could there be exploits which allow malware to write to BIOS without root at all?

  • It all depends on how the OS controls access to the firmware's EEPROM. If you chmod 777 the ROM's device node then anyone can install their malware into it and it'll get loaded on the next reboot. – user42178 Dec 30 '14 at 23:09
  • @André Daniel - what is the device node for EEPROM ? Is this some file in /dev/ ? – user1968963 Jan 15 '15 at 10:41
2

In Earlier days there was lack of access control on BIOS reflashing procedure which could introduce Rootkit into BIOS,flash chip with no root access required. In a much more recent attack, the Mebromi malware rewrote the BIOS of a machine with code that would then write a typical Master Boot Record infection routine to the first sector of the disk. This allowed the malware to persist even if the hard drive was replaced or formatted,All of the preceding attacks on the BIOS relied on the Bios being unprotected and easily writable and required no root level access

  • Disabling root access cannot prevent these bootkits or rootkits from harvesting or stronger root password because there are several ways they can infect
  • flash the BIOS via usb CD (core boot and PCI roms such as IPXE)
  • Boot a Payload over network BOOTKIT > No root required
  • Boot a Payload over wifi/Wimax > no root required
  • Remotely reflash the Bios/ Network card if necessary> no root required

Some features of these Modern BIOS/Firmware rootkits have

  1. Removes NX bit

  2. Removes CPU updates (Microcode)

  3. Removes SMM protections > SMM Used to get ring 0 access

  4. Disables ASLR

  5. removes protection to allow supervisor procedures to write into read only pages

Since their are techniques/Exploits exists to allow remote write to BIOS/Firmware as discussed by Blackhat Rakshasa Bootkit in 2012 Blackhat

Further the presence of secure boot and trusted Boot in windows 8.1 secures us from older BIOS attacks/Backdooring,however as indicated in recent research https://media.blackhat.com/us-13/US-13-Butterworth-BIOS-Security-WP.pdf it is still possible for malicious/crafty user to launch attacks

  • If I get u right ... Does that mean, disabling root user like in "TailsOS" doesn't stop malware from the Internet to write malicious code to BIOS or other firmware? – user3200534 Jan 14 '15 at 18:03
  • it can stop it and provides some mitigation but recent research shows us that a payload can also be booted over network/Wifi/Wimax and network card can also be remotely flashed – raven Jan 15 '15 at 6:22
  • Further we know current OS can be easily backdoored like windows 8.1 attaching a debugger REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe" /v Debugger /t REG_SZ /d "C:\windows\system32\cmd.exe" – raven Jan 15 '15 at 6:31
  • @raven - could you please elaborate on "network card can also be remotely flashed" ? Do you have any link where I can read more about this kind of exploit? – user1968963 Jan 15 '15 at 10:45
  • 1
    @user1968963 CoreBoot can be used to reflash Bios with SeaBios,Coreboot is also used to uninstall microcode(cpu updates),disable ASLR, etc – raven Jan 15 '15 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.