To secure my PC I have setup a BIOS password, preventing any access from a live-cd.

Recently I've noticed that when the BIOS asks for my password, I just have to press Enter to boot. It doesn't work if I type just anything, but it works if I type my actual password.

This situation is pretty worrying as it means that my computer is no longer secured.

The question is now, is there a way to check if any bios is affected, and if so how to clean it ?

  • 3
    Within BIOS you can setup 2 different passwords: one to enter BIOS to check or do some settings. The other one is to boot the system at all. Both aren't that secure, clearing the NVRAM removes those passwords. All other hardware settings are gone too, tho that doesn't really hurt. Consider using a real disk encryption. Bitlocker doesn't count.
    – ott--
    Aug 21 '15 at 21:13

The BIOS or equivalent firmware is the first thing that runs when the computer is booted, so it could easily start a lightweight hypervisor before loading the OS that will present a clean firmware image if the OS ever asks for it, while still being compromised.

So from the actual machine, there is no reliable way to check if the firmware is malicious. You can however do so from another machine by unsoldering the ROM or flash chip that holds the firmware, putting it in an appropriate reader and reading it from a known good machine (but not executing it, just merely reading) and comparing to a known good image such as one provided by the mainboard manufacturer.

  • 1
    unsoldering the chip to test it on another computer seems extreme and definitely something I can't do myself. Is there any other option ?
    – 0x1gene
    Aug 23 '15 at 11:18
  • @0x1gene sadly, no. This is the only correct option, though often you don't actually need to solder as the chip is on a socket. Aug 23 '15 at 13:20
  • It is extreme, but it is not always that difficult. You can buy an SPI programmer which often "clips" onto the chip holding the BIOS and powers the chip by itself. The other end plugs into another computer via an interface like USB and allows that other computer to read from and write to the flash/EEPROM chip.
    – forest
    Jan 30 '18 at 3:19

I'd run these programs (http://pastebin.com/BeKzci9A). I'd highly suggest trying to find out what rootkit, if any, has been installed on your system and researching how to specifically remove it on top of everything else.

Also it is highly suggested that you always boot your operating system that you know is compromised with a LiveCD, mount your infected main hard drive partition read-only, and then back up any data you wish to keep whilst scanning everything you copy over. Then you nuke the infected hard disk with DBAN and reformat, and remember to keep your backups updated.

  • 4
    If this is a BIOS attack, nuking your hard disk is like amputating your leg when you have a brain tumor.
    – David Zech
    Aug 21 '15 at 23:37
  • Oh okay, youtube.com/watch?v=lb1XDMbQOiM
    – gh0st
    Aug 22 '15 at 9:59
  • Cool video, but I don't see how it's relevant.
    – David Zech
    Aug 22 '15 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.