Newfangled rootkits survive hard disk wiping Researchers have demonstrated how to create rootkits that survive hard-disk reformatting by injecting malware into the low-level system instructions of a target computer. The researchers, from Core Security Technologies, used the techniques to inject rootkits into two computers, one running the OpenBSD operating system and the …
It really is time to bring back a hardware write protect switch. It shouldn't be a big deal because Average Joe doesn't ever have a reason to update his BIOS. The advanced users who do will figure it out.
Oh, and code signing. BIOS images should be signed. Not just the package you download over the interweb but the actual image on the flash/EEPROM.
Surely installing any rootkit requires physical or root access so reprogramming the bios is no more challenging than any other rootkit.
Sure you have to program flash, rather than just accessing a disk, but that is hardly difficult if you have the correct info available.
Could anyone elaborate on "unfettered root access"? If it means running as administrator, then that's obviously (unfortunately) a very common situation, and surely doesn't belong in the same breath as physical access in terms of how difficult these attacks might be to pull off. Paris, because... wait, no.
And the question here is, Why teh hell do we pay for Antivirus. It may be hard to inject the code and it may be even harder to read the code but at teh end of the day if Antivirus companies cannot clean our machines and OS manufacturers cannot remove the exploit then why in gods name to we pay them ridiculous amounts of money? Its quite like a scam in my opinion, they can cover you for 95% of scenarios but the other 5% you are always screwed. I understand it's a firefighting technology to which we protect ourselves in an array of ways but this kind of vuln is years and years old!!! Norton...pwah, but I'm surprised at trend and Eset. Tisk Tisk. Gimme back my money....
You mean this story?
http://www.reghardware.co.uk/2008/12/23/msi_uefi_run_through/
It has nothing to do with getting rid of the vulnerable boot rom, it's only a prettification of the same old stuff. If anything all those extra graphics and third party drivers would be MORE vulnerable to bios type rootkits.
I agree - sensible precautions to protect sensitive data aren't that hard to figure out.
Dual BIOS with one being read-only and a BIOS comparison on boot would detect infection. As others have said, a hardware write-protect switch would still allow safe BIOS updates, providing you use the BIOS' built-in update mechanism and a signed update package.
Anyone here remember the Chernobyl virus?
vicious little thing! It had a date triggered (26th of April, anniversery of it's name-sake) payload that would first begin writing random garbage over your hdd, then do the same on your BIOS.
Hard to believe it was 11 years ago when my poor little P200 succumbed to that one.
As for the people who are up in arms over the "lack of security", I'm quite suprised at the general lack of understanding of complex systems.
To put it bluntly, the more complex something is, the more things there are to go wrong with it, or in this case, the more surfaces are opened to attack.
Quite like the points raised in the Galactica article, just as they retro-fitted the ship to avoid infection, we could all go back to non-networked casio calculators. Also, the quote "let a complex system repeat itself enough times, and it may do something suprising" rings true in this situation.
Absolutes only exsist in theory, and we don't live in a theoretical universe. Though the constant strive for improvement is an honerable one, we must never lose sight of this fact.
No system is invulnerable to attack. If it can be used, it can be abused.
Paris, cause she could use and ab...
Another reason to get a VM
By David Posted Tuesday 24th March 2009 23:47 GMT
Virtualise the BIOS, then you can just can the infected machine image.
surely in order to use the virtualised bios, which needs to run on the hardware, you'd still need some way of accessing basic input and output systems to actually access the hardware?
"Of course, injecting code into the BIOS is no easy feat. It requires physical access to the machine or an exploit that hands an attacker unfettered root access."
No, it doesn't always require physical access to the machine, unfortunately, nor any exploit, only the SDK from the mobo vendor (admitedly the sources are not public, but easily reverse engineered, since is in their public exe).
Nowadays, Gigabyte for sure (with @BIOS) and probably others have moved towards SW updated BIOS.
My Gigabyte card (http://www.gigabyte.com.tw/Products/Motherboard/Products_Overview.aspx?ProductID=2695) is best updated this way, via this Windows app, and there's NO physical or BIOS switch to disallow this ! And it doesn't ask for the BIOS password !
What is even worse, is, as much as I would have liked to do it "the old way", I had to go this way, since the last PC I assembled was floppy-less.
As everyone said, bring back the old days of jumper to allow BIOS update !
How about no. It was talking about all OSes, not just stupid M$ crap.
At least for us Linux users, we don't run as root. We use sudo, and you will need to enter password to give a program "root access". It is hell a lot harder for any malwarel to deal with.
And it is fact that we normally know what we are doing, not like average clueless lusers.
I too remember hearing stories about this sort of thing years ago.
Surely though the task is made somewhat more difficult, and indeed will impact less people, simply because each mobo manufacturer uses a different firmware model and writes completely different base code, and the same manufacturer would introduce differences between all their different models too.
Intel and AMD, introduce major changes in basic chipset architecture for their reference motherboards/chipsets from the get go, simply because they're leveraging the new mobo feature sets and overall changes to the hardware.
Writing a BIRUS (cool new name???) that would sit alongside and account for the massively wide variety of different microcode architectures out there would be nigh on impossible. And if you do, it'll only run on the poor sods who bought, say, ASUSs G245R8346 motherboard?
.
Scaremongering if you ask me.
This is not that big of a deal, just flash the bios before you reload the OS on the box, problem solved, unless they prevent flashing in some way, then in that case just replace the chip. If this becomes a real problem someone will have a standard service (mail us your BIOS chip and we'll overnight you a new one) or some kit to make this easy even for consumers.
Paris well she's now crying because she doesn't know how to flash the BIOS and now has to wait an extra 5-10 minutes more for me to fix her computer.
OK, let's start by debunking the nonsense in the original report from ElReg.
"It requires physical access to the machine". Nonsense. Physical access is one of the things such an attack does *not* require. All you have to do is run a program on the machine - which can be done in the same way as you get any other malicious program (virus or Trojan) run on the machine. There are many other requirements, though, which make the attack far more difficult than the article implies.
"work on virtually all types of systems". Nonsense. In order for this attack to work on a particular system, you need:
1) The system must have a user-programmable (FLASH-able) BIOS. While many systems are like that nowadays (especially laptops), it is by far not true for all of them.
2) The BIOS should be FLASH-able by any random program - i.e., it shouldn't require the user to move a jumper or anything like that.
3) The precise way to FLASH the BIOS should be known to the malicious program. There is no standard API to FLASH any random BIOS - the different BIOS producers use different ways. While it is possible to cover "the most popular types of BIOS", it is by far not easy and it is not possible to cover them all.
4) The program must be able to find a large enough unused (or not used for anything critical) area in the BIOS, which to overwrite with the rootkit - otherwise it will destroy something important and the computer will stop working at all. Again, finding such an area is not easy and they are not at the same places in the BIOSes of all producers.
So, while it is a legitimate attack, do not expect to start seeing to tomorrow on the wide scope the article implies.
OK, now let's move to the nonsense posted in the comments - and I won't even bother with the silly and/or sarcastic remarks.
Oisin McGuigan, you can't be serious. 95% protection is precisely what you're paying for. Do the doctors cure 100% of all diseases? Does the police catch 100% of all criminals? Does any lock deter 100% of all lock-pickers? The point is that it is better to pay and have 95% protection than have no protection at all.
For instance, a program installing the kind of rootkit the article is talking about has to *run* on your computer before it can install anything. IF you have anti-virus installed and running properly and IF it knows the program, then it will prevent the program from running in the first place, so your machine will be protected.
"This kind of vuln"?? What kind of "vuln"?! Viruses require no vulnerabilities whatsoever. They rely on the fact that all von Neumann-type computers (which is all kinds of general-purpose computers in use today) cannot distinguish between code and data.
Ok assuming that most People are that stupid, tp begin with?
What would you do, when you got hit w/the next RK that S0NY decided to infect it's users with??
I agree ASUS, Giga-Byte, MSI (...and all the rest on Gilligains' Isle), should bring back the HW Switch to protect the BIOS
@Eddie:
the kiddies (who frequently also maintain mummy's PC for her) will no doubt find it an inconvenience to open the case and leave the switch open.
I once had a BIOS that "included" virus protection, e.g. it threw a warning on the screen if something tried to write to the BIOS or to the boot sector. Problem was that this completely hosed any Windows instance that was running. Maybe that should be brought back.
Alternatively, how about a momentary write-enable pushbutton on the mobo that enables writes for e.g. 1 hour?
If you have a decent AV - that simply isnt going to work.
And that stupid UK law means i cant give a brilliant answer to this :(
So this will have to do - the way antivirus products work, especially kaspersky mean such an attempt would be noticed, and therefore even a brand new user would stop it.
Having av and knowing how to use them of course - well thats a completely different story.
Scientists - the modern answer to criminal warfare.
Where I worked on the Jav before we had to have the unix and much feared the root kit.
But solution is simple in new modern times. Now we use the Windows where it has no root user in the accounts so we must fear the root kit no further. It is most happy to make us all fear the security issues a little less so I commend the windows if you suffer root worry in your enterprises.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
