Recently I purchased a server board made by Lenovo with a "Intel Management Engine" inside BIOS.
It is said that it is able to intercept and redirect keyboard input, even if an operating system is running. The whole BIOS firmware was not open-sourced, so it is possible that there are backdoors inside. And now we know Lenovo was doing some nasty things these days.
I just examined my BIOS chip using flashrom
utility in Linux. It said my BIOS has a 12288KB (~12MB) flash chip. That's too big for a BIOS!!
So, I'm feeling very wary. Maybe the extra space can be used to store users' keyboard input? And these data may be exported later by law enforcement or a hacker? That's too terrible!!
Is there any way to check if my BIOS is logging my keyboard input? And any way to stop it?
I'm currently using a USB keyboard plugged in on-board USB connectors, and I think these actions may help:
Use an external PCI/PCI-E USB controller card
Use a Bluetooth dongle + Bluetooth keyboard. (Some initramfs tweaks may needed, in order to recognize them at boot time, and input disk unlock password)
Write a new password input program for cryptsetup: Print a on-screen keyboard with random letter sequence, and use arrow keys to select them.