Foro de elhacker.net

Recent research suggests that rootkit malware can be designed to infect the flash memory of the BIOS and "live" in the BIOS, thereby surviving the "clean install" so many of us recommend as the "ultimate" and often the best solution for infestations. A clean install wouldn't remedy the infection . . . it would just come back again from the BIOS unless the BIOS was also flashed with a clean copy. Which means users would have to keep a clean copy of the BIOS handy and also know how to flash it.

 At this stage it's only been demonstrated in controlled environments by security researchers, but the malware writers can't be too far behind and some think malware bums may be ready to release something into the wild in the next few weeks.

 Don't want to sound like the-sky-is-falling Chicken Little, but this is not good news! If the malware creators find a way of injecting it into the BIOS of an infected machine there would have to be a complete rethink on the way that users are advised, and that in itself will be no mean feat either. We may have to go back to geek school to learn how to deal with this kind of nastiness .

 If the malware writers have the ability to affect a computer's flash memory with a rootkit, the BIOS would need to be configured to disable writing to flash memory. BIOS password?

 It's always a steep learning curve and the hill just got steeper!

 Security expert articles on this can be found here (http://www.theregister.co.uk/2009/03/24/persistent_bios_rootkits/) and here (http://www.theregister.co.uk/2006/01/27/rootkits_bios/).

 BIOS password issues are discussed on Tom's Hardware here (http://www.tomshardware.com/reviews/bios-beginners,1126-10.html).

 This injection is true for systems that are "open" and I quote from one article:

 "Of course, injecting code into the BIOS is no easy feat. It requires physical access to the machine or an exploit that hands an attacker unfettered root access"

 Unfettered root access = ability to make changes to the bios, aka: Flash BIOS

 Some Mainboards have Jumpers to protect before erroneously Flashing.

 Other Mainboards have a BIOS-Setup-Option called "Flash Bios Protection" (http://www.techarp.com/showFreeBOG.aspx?lang=0&bogno=88), "Firmware Write Protect", "Bios Guardian" or "BIOS-ROM Flash-Protect"

 Whether via jumper or BIOS setting, they are generally enabled to protect you, though it doesn't hurt to check for yourself to make sure.





Fuente: HowToGeek [Forum] (http://www.howtogeek.com/forum/topic/bios-malware)

hay que tener acceso directo con la maquina

It requires physical access to the machine or an exploit that hands an attacker unfettered root access.

3.4Firmware Level
If an attacker is looking to utilize a simple, and highly
undetectable, sequence of steps, a firmware level rootkit can be
extremely effective. Firmware level rootkits are implemented at
the hardware level, and lay near the bottom of the system stack.
By modifying code directly on the hardware, an attacker can
implement a program of her choosing, while remaining extremely
difficult to detect. Targets of firmware level rootkits include
peripheral hardware, disk controllers, USB keys, processors, and
firmware memory. At this point in time, firmware level rootkits
are mostly theoretical and have only recently been demonstrated
in a fully functional proof of concept. Very limited public
research has been done in this area.
The general concept of firmware rootkits is the idea that firmware
can be modified from the operating system directly. In particular,
BIOS, ACPI, expansion ROMS, and network card PXE systems
can typically be modified by administratively run code. What
makes firmware rootkits interesting is that in many instances,
these firmware devices are executed at boot time, well before the
actual execution of the operating system. This leaves a window of
opportunity for a subversive piece of firmware to hook interrupts
that may be called by the operating system at a later time. For
example, it is possible to hook the int10 interrupt, the video
interrupt, and have the firmware modify program execution based
on the execution of this interrupt. [28]
The network card PXE firmware is another interesting target. This
firmware gets executed prior to the operating system start up to
determine if the host should download and/or boot over a network
connection. Modification of this firmware leaves attack vectors
open including the ability to install, run, and potentially update a
rootkit that is located within this or other pieces of firmware. [28]
Once a rootkit has been installed in a piece of firmware it is very
difficult to remove. Reinstallation of the operating system,
formatting the hard disk, and even physically removing and
installing a new storage mechanism will not result in the removal
of the subversive code. The effected piece of firmware must be
returned to its safe state to ensure the removal of the firmware
rootkit.

[28] Heasman, J. “Firmware Rootkits and the Threat to the
  Enterprise”, Blackhat DC, 2007
    http://www.ngssoftware.com/research/papers/BH-DC-07-
    Heasman.pdf