we all know that some countries do their best to spy on their citizens and the citizen of other countries and that countries maybe have specialized spying agencies wither they are known or not, and, from my basic understanding that the most effective ways is to infect the HDD or BIOS firmware.

Now the infected HDD can be avoided by using another storage media e.g. USB pendrives and to use live boot OS that uses RAM instead of HDD e.g. Tails OS, But, the real problem that worries me is the already infected BIOS and my question is :

What can I do in order to protect my encryption private keys in case of infected BIOS? please note that I assume that the BIOS is already infected since the governments can modify and temper with BIOS firmware before it is being sold in their country.

  • Flash your BIOS with latest from vendor. Or verify the firmware signature with them. – Neil McGuigan Aug 6 '15 at 22:07
  • @NeilMcGuigan But, as I understand there are some malwares that is not able to be removed by flashing.. can you paste a link to tutorial about how to verify the firmware signature :) – Бассел Жаббор Aug 6 '15 at 22:27

IMO, the only way to be sure about your firmware is if you build it and flash it yourself, and don't let system out of your hands. Intel Tunnel Mountain and MinnowBoard are the Intel dev platforms for UEFI. You can build your own firmware on these boxes. If you are concerned about this sort of thing, you might want to use a Novena or perhaps a Purism laptop (their firmware is yet to be determined...), made by OEMs who cater to this demographic. Or use an ARM box, where you can use coreboot or U-Boot as UEFI alternatives, Linaro's compatability list of ARM dev boards often have the ability to update the firmware, and they offer UEFI or U-Boot options. Save copies of your ROM, before and after you go through checkpoints where your box is confiscated, to diff the ROMs. BIOS Diff is a tool for that. Some tools listed here: http://firmwaresecurity.com/2015/07/27/index-to-tool-review-blogs/. Thanks, Lee http://firmwaresecurity.com/feed/

  • I understand that pursim uses coreboot which is open-source bios firmware, but, it is also use binary from intel which is not open-source -as I understand- so, is there any completely open-source bios? or this will be my best bet? please explain for me I am not hardware genius, but, I am a web developer. – Бассел Жаббор Aug 7 '15 at 14:13
  • can I flash any BIOS with coreboot? how to know if my BIOS is supported or not? – Бассел Жаббор Aug 7 '15 at 14:22
  • Please indicate when your are linking to your own blog – schroeder Dec 14 '15 at 23:55

The only way to get control over your computer, that works always, is to physically replace the infected BIOS flash chip with a non-infected one (provided that only the BIOS is infected). It is possible that the flashing utilities aren't infected by the government, so you can perhaps even flash a non-infected BIOS from inside a system, which comes with its own problems to solve like how to acquire such a firmware, or by accessing the needed flashing bus via hardware tools, but generally, there is no cheap way to "bootstrap trust" out of distrust about hardware.

You will have to find out how exactly, and how deeply the government infects your computer with their spyware, and then try to counter that, the only general answer to this is to replace the actual hardware parts.


Look on Phoronix.com for Purism reviews, Michael has done a few blog posts on topic, including some controversy about what Purism is doing with their firmware. Traditional IBVs (Independent BIOS Vendors) like AMI/Phoenix/Insyde have closed source codebases. Intel has Firmware Support Package (FSP) and AMD has ASGEA(sp) which contain the necessary blobs that a firmware solution (like UEFI's tianocore.org or coreboot.org needs to work on their systems. New Linux OEMs (System76, ThinkPenguin, etc.) usually use stock BIOS from traditional IBVs, so 100% blobs. Some vendors, like Sage Engineering and apparently Purism, have Intel FSP source licenses, under NDA, so they can edit the FSP source and alter them, hopefully making things "better" (your definition, configurability or security), but they're under NDA from Intel so they probably can't say much. Open source tianocore (UEFI) or coreboot + FSP blobs is better than 100% closed-source IBV solution, if you like open source code. But today's hardware NEEDS blobs to run, look at the ancient/limited hardware that libreboot (coreboot w/o any FSP blobs) runs on. If a system's firmware has malware, and you've the right physical tools and software to reflash, and the system enables reflashing, and you have access to good rom binaries, or can rebuild new binaries, then you may be able to salvage the system. Else, it becomes a brick to be used as a doorstop. (But send me a copy of that ROM for analysis, see blog for email). Thanks, Lee RSS: http://firmwaresecurity.com/feed

  • do you mean the FSP by the good rom binaries or just the coreboot let's say in case of infected purism bios? sorry for this silly question, but, I want to understand your answer precisely and correctly. and also is there open-source alternative to fsp? – Бассел Жаббор Aug 8 '15 at 18:59
  • Read these 2 books: <firmwaresecurity.com/2015/05/09/…> and <firmwaresecurity.com/2015/08/01/…>. One gives better background on Intel FSP (and UEFI and coreboot), the other gives background on the various Intel silicon/firmware security technologies used today. Lee. RSS: firmwaresecurity.com/feed – Lee Fisher Aug 10 '15 at 0:23
  • Not only is the system ROM (UEFI or coreboot, w/ or w/o FSP blobs) present, but there can be multiple Option/Expansion ROMs available. Look at recent Thunderstrike2 to see how scary that can be (modern laptops use PCIe-based interface which contains OpROMs, Look for Legbacore's upcoming Optiom ROM Validation tool to help. Lee. RSS: firmwaresecurity.com/feed – Lee Fisher Aug 10 '15 at 0:23
  • AFAIK, The only alternative to Intel FSP is to write code by hand. Closed source IBVs may be doing this, especially older ones, pre-FSP era. If you are afraid of firmware attacks, there are no "good rom binaries", except ones you can build yourself from source code. Any NDA Purism/Sage updates of FSP need to have Purism/Sage trust (of new bins) as well as Intel trust (of orig source). Open source extreme of coreboot is the libreboot fork, which uses no FSP, but has very limited hardware support. Lee. RSS: firmwaresecurity.com/feed – Lee Fisher Aug 10 '15 at 0:24
  • Please indicate when your are linking to your own blog – schroeder Dec 14 '15 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.