New BIOS Virus Withstands HDD Wipes

[omniknight]

---

Computer viruses are nasty things. But the nasty just got nastier.

In many worst case scenarios, a hard drive wipe is the final solution to ridding a system of an infection. But the absolute worst case scenario is if a virus attacks the BIOS, making detection and cleaning an incredible challenge.

Viruses that target the BIOS aren’t new, but often they are specific to a type of hardware. Researchers have now demonstrated a new type of attack that could install a rootkit on the BIOS of common systems, making it very lethal and effective.

Anibal L. Sacco and Alfredo A. Ortego of Core Security Technologies released a presentation detailing the exploit of this “persistent BIOS infection.”
 Through the use of a 100-line piece of code written in Python, a rootkit could be flashed into the BIOS and be run completely independent of the operating system.

"We tested the system on the most common types of Bios," said Ortega in a vunet story. "There is the possibility that newer types of Extensible Firmware Interface Bios may be resistant to the attack, but more testing is needed."

Flashing a system’s BIOS requires administrative control, but that could first be obtained through a more ‘innocent’ virus that could reside on the hard disk drive. Once an attacker has admin rights, the rootkit could be flashed onto the BIOS and would remain effective even if the original virus on the hard disk were removed. Even a complete format wouldn’t rid the system of the virus.

"You would need to reflash the Bios with a system that you know has not been tampered with," he said. "But if the rootkit is sophisticated enough it may be necessary to physically remove and replace the Bios chip."

There is defense against such an attack, however, as the researchers say that a password or physical lock against BIOS flashes could block the install of the rootkit.

"The best approach is preventing the virus from flashing onto the Bios," said Sacco. "You need to prevent flashing of the bios, even if it means pulling out jumper on motherboard."


New BIOS Virus Withstands HDD Wipes - Tom's Hardware

[sadiku311]

unsaon kaha ni pgkuha once naka set-in na ang virus sah, kuyawa ani dah, tsk3

[softtouch]

This type of malware doesn't exist yet.
It is just a proof of concept.

[handsoff241]

This type of malware doesn't exist yet.
It is just a proof of concept.

whew for now

im sure the anti-vir companies are ready for this...

[merlwafu]

we hope they do.. hahaha.. and pray that they wont spread it..

[wowcebu]

huh this is new bios virus .. the imported is to update ur bios.

[madmike]

huh this is new bios virus .. the imported is to update ur bios.

huh pag sure oi

[giancarlo]

This is virus,malware etc.. so nana ba na igo ani...

[moz_k2]

Kung naa najud ni manggawas dayon ang mobo
with BIOS write-protect switch.
murag diskette ba
lolz

[jOaL]

huna huna ray dali.. ,./;'\][';