4

Is it possible for malware to be written in the BIOS section and loaded on every fresh Windows Install? If it is possible, can this affect Linux (Ubuntu and others) operating systems as well?

  • 1
    Have you tried looking this up? lmgtfy.com/?q=BIOS+viruses – KnightOfNi Apr 12 '15 at 2:22
  • 1
    I'm looked up but im interesting does it affect Linux OS – Dmitry Apr 12 '15 at 2:27
  • 2
    The first article turned up by a google search of "BIOS viruses" includes this quote: "Further investigation soon showed that the list of affected operating systems also included multiple variants of Windows and Linux." – KnightOfNi Apr 12 '15 at 2:28
  • 1
    Yeah, it can affect Linux. Linux and Windows are both operating systems. One of the main jobs of the BIOS is to get the computer to a place where it can load the operating system (Linux, Windows, etc). So, the BIOS is running before any operating system and so a BIOS virus can in principle be independent of an operating system. – hft Apr 12 '15 at 3:23
1

Yes, the BIOS is software. If it is writeable/flashable, it is possible for the BIOS to be overwritten or modified such that it performs malicious actions. The BIOS boots before the operating system and bootloader, so it is entirely possible for BIOS malware to impact and infect on each boot or on fresh installs.

This is not a windows specific problem. The BIOS provides the lowest level hardware interaction/abstraction and the OS will depend upon this code, so it may be possible to write generic or OS specific malware.

You may be interested in this paper and this presentation.

The MITRE Copernicus tool can be used to do checks for malware in BIOS.

1

Yes it is possible although newer bios has code signature protection which make this attack unprobable. The BIOS is tied to the computer architecture in this case x86/x64 and it's end goal is to load the OS. So no matter the OS even no OS you can flash (write) the BIOS.

However, the BIOS is not a malware delivery channel. For any useful work (accessing virtual memory, the file system, the network etc..) you'll need to run the malware code after the boot loader. The first stage boot loader has the same limitation and has only 640kb of space so you couldn't put much malware there. The second stage boot loader would be the first location where you could execute useful malware code after the filesystem has been setup. It is more practical to develop a device driver to deliver low level malware and leave the boot process untouched.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.