Hot answers tagged

122

Modern computers don't have a BIOS, they have a UEFI. Updating the UEFI firmware from the running operating system is a standard procedure, so any malware which manages to get executed on the operating system with sufficient privileges could attempt to do the same. However, most UEFIs will not accept an update which isn't digitally signed by the manufacturer....


61

Absolutely not. The BIOS password is only an authentication mechanism presented when the system boots or when a manual change to the configuration is made during boot. Malware which overwrites the BIOS typically does so by writing over SPI, the interface which the BIOS resides on. If malware gets enough privileges to write to SPI, and your BIOS does not set ...


47

Yes, it is definitely possible. Nowadays, with UEFI becoming widespread, it is even more of a concern: UEFI has a much larger attack surface than traditional BIOS and a (potential) flaw in UEFI could be leverage to gain access to machine without having any kind of physical access (as demonstrated by the people of Eclypsium at black hat last year).


41

Historically, the open source movement is not about security but about freedom. Basically, Richard Stallman was very dismayed at not being able to fiddle with his printer because the driver source was unavailable. OpenBSD's stance on being "secure" does not come from it being open source, but on an avowed goal and pledge to do things properly with regards ...


25

Open Source Does Not Unequivocally = More Secure/Safe Anyone CAN look at open source software/hardware, but that doesn't guarantee that "anyone" WILL look at it; further, if they do look at it, it also doesn't mean that they will disclose something that they find that could be a vulnerability. People assume too much about open source, and one of the ...


21

Leaving aside the "open source == secure" argument, you can also look at this question as "Why run a secure OS when the BIOS/firmware isn't guaranteed to be secure". Why bother locking my front door when an attacker can just break the windows? You will never make a completely secure system. What you can do is make sure you work on securing the parts that ...


20

Practically speaking, a virus is software, so can do anything that any other software can do. So the simple way answer to this question, and all others of the class "Can viruses do X?" is to ask "Does software currently do X?" Such questions might include "can a virus walk my dog?" (not without a dog-walking robot); "Can a virus get me pizza?" (yes: this ...


17

Firmware configuration Writing to the BIOS is a privileged operation, only doable by the superuser. Many BIOSes attempt to prevent this, for example by locking the SPI write bit and limiting the ability of SMM to interact with the BIOS. Unfortunately, there are so many ways to modify the BIOS that many (most?) firmware vendors do not adequately lock down the ...


16

The BCM2835 application processor that we use has no persistent storage on board, so an attack of the sort you describe isn't possible. The zero-stage bootloader is stored in real, honest-to-god ROM on the chip, and so can't be overwritten.


15

There are (typically) three types on on-boot authentication: BIOS boot password Drive locking mechanisms (e.g. HP DriveLock) Full disk encryption (e.g. TrueCrypt / OpenPGP) The BIOS boot password is simply a logical check inside the BIOS chip, which can be bypassed by flashing the BIOS manually or replacing the chip. It's a soft protection mechanism. Full ...


14

Take out the CMOS battery, which is on the inside of the computer on the mother board. Wait for 20-30 seconds (less time may be needed, but the exact time varies). This is normally a button battery. Put the battery back, boot, and there should be no more BIOS password.


13

The most common thing protected by the BIOS administrator-level password is the boot process. Someone with admin-level access to the BIOS (either by it being unprotected, or via password compromise) can set the computer to boot from whatever media he likes. This will allow an attacker to bypass access restrictions you have in place on any non-encrypted data ...


12

An attacker who can be physically present in front of the computer can also open the case with a screwdriver and have it his own way on the disk; or he can simply run off with the computer under his arm. No BIOS password will give you any protection against that. BIOS passwords offer any protection only against attackers who are assumed no to go physical at ...


12

Not in any meaningful way: the only thing this might prevent is a malicious, physical attacker rebooting the computer from a liveUSB/liveCD (and thus gaining offline accesss to your data). If you want to protect sensitive data, you need to set up some sort of disk encryption (so that the data is only accessible when your system is running); note that this ...


12

Yes, it is definitely possible. Here is an example of a malware OS update fraudulently signed with the manufacturer's private key: https://www.theregister.co.uk/2019/03/25/asus_software_update_utility_backdoor/ According to Kaspersky Labs, about a million Asus laptops were infected by Shadowhammer, with an update that appeared to be correctly signed. It's ...


11

Remote attackers have no direct connection with the BIOS. The only point of entry for a remote attacker is to send network packets. Network packets are interpreted by the operating system, and remote attacks work by exploiting a bug in an application or a component of the operating system itself. Firewalls protect against remote attacks only if they block ...


11

For Samsung 850 drives and other SSDs, your best and most secure option is to use the OPAL full-disk encryption by enabling a drive password in your system's BIOS. The way the encryption on these SSDs works is that the drive is always encrypted -- it comes from the factory with an encryption key generated and set. All data it writes and reads is encrypted/...


10

Quis custodiet ipsos custodes? Before I begin, I'd like to explain a bit about the term trust as it is used in an information security context. In infosec, trust often has the opposite meaning of what would seem logical. You want less trust. An untrusted component of a system is good, and the more untrusted components, the better. Trust means reliance. If ...


9

You are mixing up two technologies here it seems. First, there is UEFI and its Secure Boot feature. Secure Boot can be used to assure that your boot loader and your OS kernel are not tampered with. In order to do so, your boot loader and kernel need to be signed digitally and your UEFI configuration must contain the certificates/signatures needed to verify ...


8

Best option is just to encrypt the Linux partition, e.g. with LUKS. That way the Windows 7 partition can't actually access any of the data on the other partition. Technically it can still read and write to the partition (there's no way to prevent this) but the data it sees is all encrypted.


8

Normally, no. Not in a self-bootable area. You might have data not overwritten by the disk wipe, in "out-of-band" areas, but those areas aren't normally accessible, and if made so, they also become accessible to the wipe. Theoretically, for very large values of theoretically, yes. In some hard drives, there may be a third memory area that is accessible, ...


7

BIOS Most memory chips I've worked with have a W or R/W pin which selects the write mode. Physically tying that one to appropriate logical level should do the trick. Write-protected USB drives I'm a bit suspicious about this one. I've implemented microcontroller<->SD card interface, and the "write-protect" bit is handled completely in software, so you ...


6

In the past, it was a logical control on the physical drive. Even swapping out the drive electronics couldn't circumvent the password, so it took advanced tools, or hacked hardware to bypass the password. Some 5 years ago or so, they began to do AES encryption on the disk itself, shipping the disk encrypted and encrypting the key with your password when ...


6

There are EFI attacks that have wide-scale impact (in the case of the linked document, apparently to all Mac laptops not running a recent system update). Attacks on firmware have occurred in the wild as well. In short, such attacks are possible and are probably happening; it just might be that not many people are talking about them.


6

The strength of an encryption solution is directly tied to the number of possible passwords. A brute force attack simply tries all possible passwords so it will succeed more quickly if the number of distinct passwords is smaller. Case insensitivity means the attacker only has to try lower case passwords since 'EXAMPLE', 'eXamplE' and 'ExAmPlE' would all be ...


6

For reference, should anyone still be looking for an answer. Turns out it is because most BIOS' will use the scancodes of the keys it (the individual BIOS) supports for password input. The shift and caps lock are ignored in laptops I've encountered (Lenovo, HP, Dell; business line laptops).


6

Open source (free/libre) software is not (primarily) about security. One of its more important aspects is trust: you can verify what's running, it is much harder to hide something malicious. Some people also claim to more people will (might) be reading the code, which means chances are higher of vulnerabilities being found and fixed, resulting in higher code ...


6

Is password hashed before saving to CMOS? Depends on the BIOS. Which hash algorithm is used? Depends on the BIOS. How much storage is dedicated for passwords? Depends on the BIOS. What is about passwords of SSD with AES? Does BIOS save it inside drive (just pass it to device for further processing)? There are a lot of different technologies for ...


5

A well designed TPM should be pretty resilient to tampering, but a truly determined attacker could try doing something like dissolving the casing and reading information directly off the chip. It's a pain staking and highly technical process, so probably isn't a likely case in most situations, but if the value of the material is known to be high enough, it ...


5

I would suggest that you look into the direction of Trusted Computing. It won't "defend" you, but it might help you ensure that you are booting in a known/secure environment. There is a load of information available here, just search for TXT and trusted computing. But for starters, you can ensure this by using a platform with a TPM and Intel TXT, then go ...


Only top voted, non community-wiki answers of a minimum length are eligible