Your PC's trusty BIOS could make an attractive cyber target
Connecting state and local government leaders
The Basic Input/Output System that boots a computer before the operating system is engaged could be an attractive target for sophisticated exploits. The National Institute of Standards and Technology has released guidelines for securing the BIOS.
The Basic Input/Output System that boots a computer operates in a uniquely trusted fashion. That could make it an attractive target for sophisticated attacks, and the adoption of more standardized forms of BIOS also could help to make them easier targets.
The National Institute of Standards and Technology has released guidelines for securing the BIOS. Special Publication 800-147, “BIOS Protection Guidelines” contains steps that vendors can take to help ensure that the BIOS is not compromised through malicious updates, as well as recommendations for managing the BIOS in an operational environment.
“This is a new focus for us,” said Andrew Regenscheid, one of the authors of the report. “The industry is in transition now,” with the adoption of the Unified Extensible Firmware Interface for BIOS. “We saw we had an opportunity to influence the next generation.”
Related stories:
Next PIV card could include iris recognition
NIST document 'brings it all together' on FISMA
The BIOS boots a computer when it is turned on, initializing important hardware components and loading the operating system. It also loads and initializes system management functions such as power and thermal management and loads CPU microcode patches during the boot process.
“As the first code that is executed by the main CPU, the system BIOS is a critical security component of a computer system,” the publications states. “While the system BIOS, possibly with the use of a Trusted Platform Module, can verify the integrity of firmware and software executed later in the boot process, typically all or part of the system BIOS is implicitly trusted.”
Its critical responsibilities make the BIOS a potentially attractive target for attack. Because the BIOS runs early in the boot process with very high privileges, malware running at the BIOS level might be difficult to detect, and because the BIOS loads first there is no opportunity for anti-malware products to scan the BIOS.
To date, however, there have been few known instances of BIOS-level malware.
“At this time, the only publicly known malware targeting the system BIOS that has infected a significant number of computers is the CIH virus, also known as the Chernobyl virus, first discovered in 1998,” according to the guidelines. “One element of the payload of this virus attempted to overwrite the BIOS on systems using a specific chipset that was widely deployed at the time. This malware relied on several vulnerabilities that are not present in modern machines.”
But the adoption in new x86-based computers of Unified Extensible Firmware Interface, which is built on a common set of specifications, make it easier for malware to target the BIOS in a widespread fashion, NIST warns.
BIOS exploits still would likely be system-specific, directed at a specific version of a BIOS or hardware components such as a particular motherboard chipset. Most malware has targeted software executing at or above the operating system kernel, which allows larger classes of machines to be compromised.
But recent trends among criminals and hackers have been toward sophisticated attacks against specific, high-value targets. BIOS-level malware could be employed in targeted attacks on high-value systems.
“We are trying to get out ahead of the emerging threat,” Regenscheid said.
The guidelines do not address supply chain threats, but identifies four threat vectors during the systems lifetime:
User-initiated installation of a malicious BIOS through manual updating. This is difficult to prevent, but security processes might detect it after the fact and restore the system to an approved BIOS.
Targeted malware could exploit weak security controls to exploit vulnerabilities in a specific BIOS, either via network or removable media.
Network-based system management tools could be used to push a systemwide attack on BIOSes. This would require either an insider or a compromise in the organization’s update process.
Systems could be rolled back to an authorized but unpatched or vulnerable version of a BIOS.
Recommendations for vendors focus on ensuring that updates of the BIOS are performed securely. These include requiring digital signatures to authenticate updates, using a secure process to locally load the initial BIOS image or to recover from a corruption, requiring strong authentication for BIOS updates, and ensuring that secure processes cannot be bypassed.
Recommendations for BIOS management in the enterprise environment address provisioning, platform deployment, operation and maintenance, recovery and disposal.
“Most of the recommendations are not advanced techniques,” said Murugiah Souppaya, another author. The intent is to provide the same level of assurance at the boot level as is found higher in the software stack.
NEXT STORY: Xerox DocuShare CPX unclutters the digital paper