3

Recently I purchased a server board made by Lenovo with a "Intel Management Engine" inside BIOS.

It is said that it is able to intercept and redirect keyboard input, even if an operating system is running. The whole BIOS firmware was not open-sourced, so it is possible that there are backdoors inside. And now we know Lenovo was doing some nasty things these days.

I just examined my BIOS chip using flashrom utility in Linux. It said my BIOS has a 12288KB (~12MB) flash chip. That's too big for a BIOS!!

So, I'm feeling very wary. Maybe the extra space can be used to store users' keyboard input? And these data may be exported later by law enforcement or a hacker? That's too terrible!!

Is there any way to check if my BIOS is logging my keyboard input? And any way to stop it?

I'm currently using a USB keyboard plugged in on-board USB connectors, and I think these actions may help:

  1. Use an external PCI/PCI-E USB controller card

  2. Use a Bluetooth dongle + Bluetooth keyboard. (Some initramfs tweaks may needed, in order to recognize them at boot time, and input disk unlock password)

  3. Write a new password input program for cryptsetup: Print a on-screen keyboard with random letter sequence, and use arrow keys to select them.

|improve this question
  • why are you concerned about keyloggers so specifically. There is a lot bigger threats that the manufacturer can do with extra space in the BIOS – schroeder♦ Aug 13 '15 at 16:19
  • I know I'm not very familiar with information security... But the most part of my system is protected by passwords. I have several HDDs and each of them is encrypted by a long unique password. (Personally, I can remember very long passwords generated by "openssl rand -base64".) – Satori Komeiji Aug 13 '15 at 16:27
  • 1
    If someone has access to your BIOS, you would be more concerned of rootkits rather than just a keylogger. – David Zech Aug 13 '15 at 17:56
  • 1
    @ott A concern is what if the BIOS loads something other than a genuine Linux Kernel. – David Zech Aug 13 '15 at 18:56
  • 1
    if Lenovo wanted to play hockey, they could make it so that the BIOS would report its size to be whatever size you expect it to be, and then actually have a hidden 8GB flash memory inside it. You'd never be able to suspect what's happening unless you have an electron microscope and peek into every single chip in the computer. – Lie Ryan Feb 20 '16 at 9:05
3

Since the BIOS is generally the first thing that runs in a computer, using a PCI/PCI-E USB controller, bluetooth, or on screen keyboard would only "protect" you if the attacker didn't consider these cases.

This is still a problem because you're depending on whether or not the attacker did attack something rather than whether or not they can attack something.

While you can still count the number of BIOS attacks that have ever been published with your hands, technologies like Intel TXT can allow administrators enforce and audit BIOS security.

Unfortunately, this doesn't protect end users from nefarious code distributed by Lenovo themselves (which they now have a track record of). Essentially the only way to identify and prevent some sort of BIOS based keylogging attack is to:

  1. Dump and Examine the BIOS yourself.
  2. Use hardware from a vendor you trust more.

Ethical Disclaimer: My job involves Intel TXT

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.