Skip to main content

A few more details regarding the peristent BIOS infection

If you were lucky enough to attend this year's CanSecWest conference than you probably sat through Anibal Sacco and Alfredo Ortega's talk on the BIOS infection, and how this would persist even through a hard-drive wipe / operating system reinstall. These guys are extremely bright and are pushing hard at the edge of security research.

The slideshow published by Core Security, provides the overview, which I'll summarize here with what I can remember of the technology and tools used to enable the hack shown at the conference.

First is getting a copy of a BIOS to hack. There are two options, and one which made the researcher's lives easier, VMware supplies both a generic "virtual" BIOS and a debugger which makes testing and developing the patches easier. A generic tool also exists which they have created to retrive, modify and reflash the BIOS based on previous work by pinczakko.

The second thing talked about is the structure of the BIOS which gets executed by the CPU when the computer first boots, and the operating system has not yet loaded. The whole point of describing this structure is that BIOS structure differ between different manufacturers and models of motherboards, and these differences make it difficult to predict where to make certain changes. The researchers found that almost all modern BIOS versions however use the identical decompression utility used to expand other pieces of code in the BIOS for devices such as video cards, north and south bridges, etc. This code is easy to find using pattern matching in the BIOS. Once this section of code is found, it can be patched with a different decompression utility, making the hack possible. The other cool thing, if I'm not mistaken, about the decompression utility is that it is OS independent meaning that it will run on multiple CPU architectures (x86, AMD64, etc).

One of the key features of the BIOS is having access to the computer's hardware before the operating system, which makes doing things like patching hard disk bytes possible. Once just has to know what to search for (password files, ini files, etc) and changes can be made directly.

They also hint at being able to do other things with the code, like utilizing, accessing, modifying other devices which are interfaced with at boot time (video, ethernet, RAID, etc). This is cool because one of the things that loads in most modern BIOS is netboot or Preboot Execution Environment (PXE). Imagine that as the PC boots that a network stack is enabled, a malicious site is contacted for updated code, and additional hacks performed as desired, seems like the ultimate, very-hard to detect rootkit.

Even more concerning would be the creation of BIOS resident blue-pill type hypervisor.

UPDATE: Alfredo has informed me that the did not develop CoreBoot, they use the great opensource tools found here. Core Security developed their own toolset for these tasks CoreBoot. This project contains the code necessary to flash, patch and calculate the right checksums for the BIOS to work properly. They have not posted this on their public site, and am not sure if they intend to.

*Very cool stuff indeed.*

Comments

Mark Linton said…
Oh, one more thing Alfredo also mentioned that there is an easy way to prevent infection - by hardware shorting two of the pins. Time to get out the tinfoil hat and soldering kit!
Alfredo said…
Excellent review of our Talk, I'm glad that you liked it! Only want to point out that Core Security didn't develop CoreBoot, it's just an unfortunate name coincidence :) Coreboot is a great opensource project on it's own.

Popular posts from this blog

Consumer Benefits of Credit Card Security

Recently, new types of credit card security features have be debuted, such as this one from Visa. And as some of the comments on Bruce Schneier's blog point out, its questionable how effective this is. I want to figure out what the motivation is behind these ideas, as it appears banks and the major credit card brands are not completely transparent about the benefits to the consumer. My example is this, one source has that in 2005 $2.8 million was lost due to credit card fraud from Visa and MasterCard in Canada alone. These costs are absorbed by the credit card companies as they protect their cardholders from liability, but as can be expected these costs are directly applied to the card brand customers, people and merchants, in the form of fees and interest rates. Now lets say that card brands can deploy a technology to eliminate 90% of this fraud and associated insurance and liability costs. Likely a large savings both in Canada and globally. Would we, the public and mercha

OpenSolaris, ZFS, iSCSI and OSX - Creative Storage - Part II

In part I of this post, I looked at the simple steps required to setup a relatively simple storage solution using OpenSolaris, ZFS, iSCSI and OSX. This was about a month ago, and I've made some significant changes on how this is used for me. At the end of the last post I left off on the part dealing with configuration of the iSCSI initiator side of the solution. I stopped here because there were some issues related to the installation and use of the software. The iSCSI initiator that I was using was Studio Network Solutions GlobalSAN initiator (version 3.3.0.43) which is used to allow for connections to their products. This software will also allow for connections to ANY iSCSI target! After the configuration of the iSCSI target on the ZFS pool, and installation of the client it was trivial to get the connection established with the storage pool, and it showed up in OSX as a raw disk which had not been formatted. I proceeded to format the disk as HFS+ and it then mounted as a lo

May Security Catch-up

Its been much too long since my last post - Sony's PSN network has been breached a few times , a record number of vulnerabilities have been published , and the US government has released a new set of cyber space strategies . On the cool tools and technologies there have been lots of notable releases: Some research from Albert Cotesi New Zealand on the traffic flowing from IOS to 3rd parties, now sniffable thanks to MITMProxy , and instructions on getting it working with IOS As always SQLmap is making life easier for the vulnerability assessor and pen-tester. Microsoft has released an updated to the Enhanced Mitigation Experience Toolkit - I'll be looking into this over the next few weeks, and how it can be applied practically. New major version of Backtrack also released, for those of you that are still relying upon live-cd's as a source for tools.