Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Safer Boots: Feds Urge Malware-Resistant BIOS

NIST advises PC and server makers strengthen the security of BIOS ROM chip flashware. Attacks against BIOS can be used to create persistent rootkits that survive reboots.

11 Security Sights Seen Only At Black Hat
11 Security Sights Seen Only At Black Hat
(click image for larger view and for slideshow)
Memo to manufacturers: Improve the security of the BIOS ROM chip flashware running on PCs and servers.

That's the gist of a recently released draft report from the National Institute of Standards and Technology (NIST), which offers advice on how manufacturers can better protect the BIOS flashware used on servers. NIST currently is soliciting comments on the draft report, which can be filed with the agency until Sept. 14, 2012.

Why worry about the BIOS? "Unauthorized modification of BIOS firmware by malicious software constitutes a significant threat because of the BIOS's unique and privileged position within the PC architecture. Malicious BIOS modification could be part of a sophisticated, targeted attack on an organization--either a permanent denial of service or a persistent malware presence," says the report.

Previous examples of BIOS-infecting malware are relatively rare, but include the Windows-targeting CIH or Chernobyl virus, which appeared in 1998 and could flash a BIOS and corrupt it, after erasing the data on a PC.

[ Leave hacker payback to the experts: Strike Back At Hackers? Get A Lawyer. ]

But worries over BIOS security have been growing, especially since researchers in 2009 demonstrated a technique for injecting code into any unsigned firmware. Last year, security researchers discovered a BIOS-altering rootkit called Mebromi, which can alter boot-time instructions in the BIOS, which in turn alter the computer's master boot record (MBR). When the PC powers on, firmware in the BIOS ROM loads and executes the MBR, which is the sector at the very beginning of a hard drive, and thus the first to load.

Infecting the BIOS and MBR makes it difficult for antivirus software to find or eradicate the malware, raising the possibility that attackers could create boot-proof and antivirus-resistant rootkits.

"Developing an antivirus utility able to clean the BIOS code is a challenge, because it needs to be totally error-proof, to avoid rendering the system unbootable at all," said Webroot security researcher Marco Giuliani last year, in his analysis of Mebroni. In fact, even small coding errors made when trying to repair a BIOS could brick the machine. On the upside, however, in the case of Mebroni, the malware could only infect PCs with a BIOS ROM made by Award, which is part of Phoenix.

As Mebroni demonstrates, servers aren't the only systems at risk from a BIOS attack. Last year, NIST released "BIOS Protection Guidelines" for PC manufacturers, to help them prevent unwanted BIOS modification on PCs by attackers.

The report warned that BIOS implementations could become more susceptible to such attacks in the future. "The move from conventional BIOS implementations to implementations based on the Unified Extensible Firmware Interface (UEFI) may make it easier for malware to target the BIOS in a widespread fashion, as these BIOS implementations are based on a common specification," it said, meaning that attackers could potentially hit more targets at once with a single piece of malware.

Accordingly, NIST recommends that manufacturers begin cryptographically signing their BIOS updates, and treating the BIOS as an essential part of PC security. "By building security into the firmware, you establish the foundation for a secure system," report co-author Andrew Regenscheid told ScienceDaily.

Mobile employees' data and apps need protecting. Here are 10 ways to get the job done. Also in the new, all-digital 10 Steps To E-Commerce Security special issue of Dark Reading: Mobile technology is forcing businesses to rethink the fundamentals of how their networks work. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27187
PUBLISHED: 2020-10-26
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related command...
CVE-2020-7752
PUBLISHED: 2020-10-26
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CVE-2020-7127
PUBLISHED: 2020-10-26
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVE-2020-7196
PUBLISHED: 2020-10-26
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the ur...
CVE-2020-7197
PUBLISHED: 2020-10-26
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* U...