Click here to close now.

Welcome!

Security Authors: Liz McMillan, Pat Romanski, Srinivasan Sundara Rajan, Elizabeth White, Kevin Jackson

Related Topics: Security, Java, SOA & WOA, .NET, Web 2.0

Security: Article

BIOS: Overview and Security

Basic Input/Output System (BIOS), also known as the system BIOS or ROM BIOS, is a standard defining a firmware interface

Computer security has become much harder to manage in recent years, and this is due to the fact that attackers continuously come up with new and more effective ways to attack our systems. As attackers become increasingly sophisticated we as security professionals must ensure that they do not have free rein over the systems that we are hired to protect. An attack vector that many people forget to consider is the boot process, which is almost completely controlled by the BIOS.

The BIOS is a privileged piece of software that is generally ignored by day-to-day users and thus they are usually unable to comprehend the importance of it in our computers. The Basic Input/Output System was first invented by Gary Kildall for use in his operating system CP/M and this became what we now know as the conventional BIOS system. The BIOS appeared in IBM-compatible PCs around 1975 and was used extensively in the CP/M operating system. This was later used in the MSDOS systems where it was known as DOS BIOS. These systems were only responsible for basic preboot hardware initializations before handing over control to the bootloader. This was fine 30 years ago, when software was simpler and attacks were not very predominant, thus the BIOS was not designed with security in mind. However, in today's world this is no longer the case. BIOS security lacks several features that make it vulnerable to external attack.

These are some notable attacks carried out against BIOS systems:

Chernobyl Attack (1998) - Also known as CIH or Spacefiller was the first major attack on BIOS systems. This virus installs on the windows memory and hooks into file access calls and infects all the currently executing programs. Then the virus tries to flash the BIOS rom by filling it with zeros. The other payload infects the Master Boot Record (MBR) by filling the first megabyte of the hard disk with zeros.

Mebromi (2012) - Is made up of a BIOS rootkit, MBR rootkit, Trojan downloader and PE infector. This Trojan deletes a specific registry value and checks for the BIOS manufacturer. If it's Award BIOS, it then infects the BIOS ROM and in turn infects the Master BOOT Record (MBR) and alters it allowing the execution of an infected program at each Operating System start-up.

We attempt to prevent such attacks by outlining several attack vectors and also suggest several mechanisms for the mitigation of attacks against the BIOS.

BIOS (Basic Input Output System)

Basic Input/Output System (BIOS), also known as the system BIOS or ROM BIOS, is a standard defining a firmware interface. BIOS software is built into the PC, and is the first software run by a PC when powered on. The fundamental purposes of the BIOS are to initialize and test the system hardware components, and to start the boot loader or an operating system from a secondary storage device. It also takes care of essential system functions such as power management and temperature regulation. It provides an abstraction layer for the underlying hardware by providing a consistent way for operating systems and application programs to interact with various input/output devices.

Changes in system hardware are abstracted by the BIOS from programs that use BIOS services instead of directly accessing the hardware. BIOS software is stored on a non-volatile ROM chip on the motherboard. Its unique design makes it compatible for particular models of computer, interfacing with various devices that make up the complementary chipset of the system. In modern PCs the BIOS contents are stored on an EEPROM chip.

An EEPROM chip or Electronically Erasable Programmable Read only memory is a type of non-volatile memory used by many electronic devices that requires small amounts of data to be stored for quick access. The contents of an EEPROM chip can be flashed, i.e., they can be overwritten with new data. This allows BIOS software to be easily upgraded to add new features and bug fixes. This feature is also one of the reasons that BIOS chipsets are vulnerable to attack.

Why BIOS Is in Blue
Most BIOS Screens will be blue; this is due to how the BIOS Manufacturers implement general BIOS color attributes. BIOS Color Attributes are 8-bit values where the lower 4 bits represent the character color and the higher 4 bits represent the background color. In BIOS, to print a white character in blue background the ‘BIOS colour attribute' would be set to a hexadecimal value of 0x1F.

Under certain conditions, setting the highest bit of the background color may cause the text to blink instead of making the background color intensified. In this context the highest bit of the background color should be kept low according to the BIOS color attribute distribution. As a result the Blue color which comprises value '1′ in hexadecimal is generally used for an uninterrupted BIOS display with intensified background with clear text.

Top BIOS Manufacturers
BIOS software is developed by several companies around the world and are usually deeply integrated with the system motherboard. Several of the most popular BIOS manufacturers are:

  • American Mega Trends
  • WinBond
  • Phoenix
  • AMI
  • IBM
  • Award

Role of BIOS
The BIOS has an essential role in the boot process of the computer also known as bootstrapping. It initializes system hardware, manages ACPI, and regulates CPU temperatures during the booting process. The major responsibilities of the BIOS are listed below:

  1. Establish Trust: The BIOS is responsible for verifying the integrity of all the hardware components in the system and also to authenticate them before use. This is done with the help of Core Root of Trust Measurement (CRTM), which basically checks if the hardware is valid and that its integrity has not been compromised.
  2. Test Hardware: The secondary functionality of the BIOS is to initialize and test the hardware present on the computer before it's used. Hardware such as the motherboard, chipset and memory are included in this test. This is generally carried out during POST (Power-On-Self-Test).
  3. Load additional Modules: Several devices present on the computer may require additional firmware for its proper functioning. The BIOS ensures that such additional firmware modules are loaded and executed. These may be stored in the BIOS chip itself or some secondary storage device.
  4. Boot Device Selection: After the above steps have been carried out, the BIOS starts to detect a valid boot device, e.g., USB drives, dard disk, etc. Once such a device has been found it executes the bootloader found on that device.
  5. Start Operating System: After this the actual bootstrapping process begins, the bootloader starts to execute and begins to load the OS kernel into memory. Once the kernel has been initialized the BIOS transfers full control to the Operating System.

BIOS Overview
System BIOS can be of two types namely:

  • Legacy BIOS
  • BIOS based upon the UEFI specification

Conventional BIOS (Legacy BIOS)
The Legacy BIOS or conventional BIOS is the tried and true BIOS type that has been around for years. It's generally a 16-bit program that is flashed onto a ROM chip and placed in the motherboard of the computer. This type of BIOS is very outdated and more vulnerable to attack, therefore it's advisable to use a newer and more stable specification.

The key component in conventional BIOS is a boot block. This part is logically separated from other parts of the BIOS and initially executed during the BIOS boot process. Then the boot block checks the integrity of the remaining firmware in BIOS and if any is corrupted recovers those. The boot block then initializes almost all the hardware associated with the system by using a Power-On-Self-Test (POST). During this procedure low-level hardware components like Memory, CPU, Chipset, etc., are initialized.

After this process, it then loads other option ROMS like Video Cards, SCSI Controller Cards, and Network Boot ROM that have their own BIOS software. This Option ROMS could inform the BIOS about its functionality, and then it could be called later on in the boot process depending on the order the user had selected. Then the BIOS checks the Master BOOT Record (MBR) in the order of the boot device's priority. If any storage device has a valid data that relates to MBR, it is selected. MBR then points to a corresponding boot loader of an operating system and thus in turns loads the operating system.

In a conventional Boot process, the System Management Mode (SMM) can be initiated by using SMI handlers and ACPI table's code. System Management Mode is a 32-bit mode that runs on high-privileged mode that can override almost all the hardware security mechanisms of the protected mode. In order to change to SMM mode, BIOS loads SMI handlers and initializes the ACPI tables and codes

Legacy BIOS Boot Process
When a computer is first powered on the BIOS is the first piece of software that is executed. The boot block then executes a POST (Power-On-Self-Test), thereby ensuring that all the hardware on the system is valid and accounted for. After the POST screen the user has the option to load the BIOS screen or to continue booting the current operating system instead. This is done by pressing a pre-designated key on the keyboard. This key may vary depending on the BIOS manufacturer. The BIOS then checks if any additional pieces of firmware have to be loaded for individual devices on the computer if so, then these modules are loaded and executed.

Unified Extensible Firmware Interface (UEFI)
UEFI (Unified Extensible Firmware Interface) is a specification that was first designed by Intel in the 1990s for its Itanium range of computer systems. It was originally called the EFI specification and was intended to be a better replacement for legacy BIOS systems. UEFI has several advantages over the conventional BIOS and is radically different from these older systems.

The UEFI specification defines a programmable software interface that lies between the device firmware and the operating system. It provides an almost OS-like interface to device firmware. Depending on the manufacturer it may lie on top of the BIOS but it's generally placed in the /EFI/ directory on some form of non-volatile memory. This may either be a NAND chip on the motherboard, a hard drive or even on a network share.

Differences Between UEFI and Legacy BIOS
There are several differences between conventional BIOS and UEFI systems and many of them add greater functionality and power to the computer. It also provides a more efficient and secure booting mechanism.

  1. Larger Address Space: Conventional BIOS were forced to work in a 16-bit mode with a maximum of 1mb addressable space. UEFI allows running in 32- and 64-bit mode allowing larger and more sophisticated programs to be run by the UEFI.
  2. Support for Larger File Systems: Traditional BIOS only supports the booting of disks that have MBR partitions. MBR partitioning schemes only support 4 partitions per disk and a maximum size of 2TB. UEFI supports the booting of GPT partitions (GUID partitions), which allow the booting of extremely large disks up to 8Zb.
  3. Improved Security Capabilities: The UEFI specification also improves on the security aspects of the older BIOS systems. It supports several security features such as secure boot. It also has provisions for providing basic cryptographic and public key infrastructure.
  4. CPU independent design: UEFI has employed a CPU independent design methodology, i.e., it can run on many different types of architectures. The code available is compiled differently for the required platform.
  5. Powerful Execution Environment: The UEFI specification provides a much more powerful execution environment for computers. It allows special features such as booting over a network, using the mouse, ACPI control and even browsing the web.
  6. Improved Performance: UEFI-compliant operating systems have been seen to have a significant performance boost not just during the boot process but also during running and powering off the system.

Windows 8 uses UEFI
UEFI, although supported by several operating system vendors for years, has not seen widespread adoption until the release of Windows 8. Windows 8 has tried to incorporate the best parts of UEFI into their latest operating system release particularly the secure boot feature.

Secure Boot
One of UEFI's most interesting feature is called Secure Boot; it allows you to boot only an authenticated OS kernel. Windows 8 relies heavily on this method to ensure that only authenticated firmware with a validated kernel image can be booted. This is quite different from older bootstrapping methodologies where any kind of bootloading code can be loaded and executed by the BIOS.

In secure a boot before the BIOS gives full control to the OS, bootloader makes sure that the firmware has been signed. This is done with the help of cryptographic signatures that are embedded on the firmware by the OEM. During the boot process the firmware will compare the platform key with the key present in the firmware of each device. This comparison is carried out between a database of authenticated valid keys; if the key is allowed then the firmware is allowed to execute, otherwise it is rejected.

This allows only authenticated devices to be loaded and ensures that malicious bootloader code is not loaded and executed. The safe boot mechanism in Windows 8 significantly reduces the chances of boot sector viruses and bootkits from launching and affecting the boot process of the machine.

UEFI Boot Process
The UEFI boot process is much like the boot process in conventional BIOS with a few minor changes. The process is divided into stages that take place sequentially and ends with the complete handover of control to the operating system. UEFI booting runs in a 32-bit or 64-bit protected mode on the CPU, not in a 16-bit mode, unlike legacy BIOS.

UEFI also starts with a small amount of code that begins the execution of the entire booting process. This phase is called the security phase (SEC) and it acts as the core root of trust. This is followed by the Pre-EFI initialization (PEI). This mode is similar to the Legacy bios pre-boot initialization phase in which device firmware is checked before boot. Then the driver execution environment is started where the actual initialization of extra device drivers takes place; devices such as network cards and graphic cards are checked in this phase.

The boot device is selected during the BDS (Boot Device Selection) phase. This then transfers control to the bootloader that is located in a GPT partition; the bootloader handles the loading of the OS kernel into memory.

Common BIOS Threats
BIOS is always written to a non-volatile storage device such as an EEPROM which allows the content of the ROM to be overwritten to introduce bug fixes and updates for the particular BIOS version. However this also has great potential for misuse such that malicious programs may also have the ability to modify the contents of the ROM disk if given enough access.

User Initiated Attack
This type of attack is carried out by an end user who uses an unauthenticated file to update the BIOS.. This can be carried out by an end user who doesn't have prior knowledge about the update file or a user with malicious intent.

Malware Attack
Malware attacks can be used to exploit vulnerability in bios. The attacker opens a backdoor to the system and cause a BIOS. crash using a vulnerable update version of BIOS.

Network Based or Organizational Attack
This is a large scale and crucial attack on an organizational basis. An attacker who gets access to a compromised update server can carry out an organizational wide attack and infect all systems by rolling out all authorized BIOS. versions to malicious ones.

How Do We Mitigate Common BIOS Threats
This section describes the security measures that an organization should implement in order to secure the BIOS. Since vulnerability in BIOS is crucial point to a system, it is important that every organization should follow predefined guidelines to secure the BIOS structure. The following method can be implemented in an enterprise structure to enhance BIOS security

In order to overcome the malicious attacks on BIOS, we can implement following methods:

  • Digital Authentication Method
  • Rollback Prevention Method
  • Physical Authentication Method

Automated Authentication Method
In this method, the authenticity of BIOS can be ensured through digital signatures. Here BIOS updates should only be installed if its authenticity is verified. Here digital signature embedded update images by BIOS manufactures will be the last level of authorization. This process can be automated by using a signature verification algorithm that ensures the validity of the digital signatures. This digital authentication method must be integrated by providing strong security features.

Rollback Prevention Method
Implement a mechanism that ensures the update images of BIOS so that it will not be rolled back to previous versions. This method ensures that if an update image is to be installed, it should be ensured that its version number is greater than the current one. This can ensure that the b BIOS version is not roll backed to a previous image that contains vulnerability.

In some cases if the current higher version has to be rolled back to a previous lesser version, i.e., if the current updated version of the BIOS contains vulnerability and there are no higher version updates to be installed and the earlier lesser version is stable than the current one. In this case the corresponding authority has to ensure that the lesser version does not contain any vulnerability.

Physical Authentication Method
This method provides the authenticity of updated images by ensuring the physical presence of the corresponding authority (system administrator). Here the authorities can verify the update images and update the BIOS, if the image is a valid one. This method can be used as a subsidiary to digital authentication method by providing as a recovery mechanism in situations like bios crash.

References

  1. www.wikipedia.org
  2. http://csrc.nist.gov/publications/nistpubs/800-147/NIST-SP800-147-April2011.pdf
  3. http://csrc.nist.gov/publications/drafts/800-155/draft-SP800-155_Dec2011.pdf
  4. http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx

More Stories By Albert Fruz

Albert Fruz has 5 years of experience in the information security field, encompassing SIEM, malware analysis, ISO 27001 audits, rule-based auditing for firewall forensics and PCI dss audits.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
Hadoop as a Service (as offered by handful of niche vendors now) is a cloud computing solution that makes medium and large-scale data processing accessible, easy, fast and inexpensive. In his session at Big Data Expo, Kumar Ramamurthy, Vice President and Chief Technologist, EIM & Big Data, at Virtusa, will discuss how this is achieved by eliminating the operational challenges of running Hadoop, so one can focus on business growth. The fragmented Hadoop distribution world and various PaaS solutions that provide a Hadoop flavor either make choices for customers very flexible in the name of opti...
One of the biggest impacts of the Internet of Things is and will continue to be on data; specifically data volume, management and usage. Companies are scrambling to adapt to this new and unpredictable data reality with legacy infrastructure that cannot handle the speed and volume of data. In his session at @ThingsExpo, Don DeLoach, CEO and president of Infobright, will discuss how companies need to rethink their data infrastructure to participate in the IoT, including: Data storage: Understanding the kinds of data: structured, unstructured, big/small? Analytics: What kinds and how responsiv...
Since 2008 and for the first time in history, more than half of humans live in urban areas, urging cities to become “smart.” Today, cities can leverage the wide availability of smartphones combined with new technologies such as Beacons or NFC to connect their urban furniture and environment to create citizen-first services that improve transportation, way-finding and information delivery. In her session at @ThingsExpo, Laetitia Gazel-Anthoine, CEO of Connecthings, will focus on successful use cases.
Sensor-enabled things are becoming more commonplace, precursors to a larger and more complex framework that most consider the ultimate promise of the IoT: things connecting, interacting, sharing, storing, and over time perhaps learning and predicting based on habits, behaviors, location, preferences, purchases and more. In his session at @ThingsExpo, Tom Wesselman, Director of Communications Ecosystem Architecture at Plantronics, will examine the still nascent IoT as it is coalescing, including what it is today, what it might ultimately be, the role of wearable tech, and technology gaps stil...
The Workspace-as-a-Service (WaaS) market will grow to $6.4B by 2018. In his session at 16th Cloud Expo, Seth Bostock, CEO of IndependenceIT, will begin by walking the audience through the evolution of Workspace as-a-Service, where it is now vs. where it going. To look beyond the desktop we must understand exactly what WaaS is, who the users are, and where it is going in the future. IT departments, ISVs and service providers must look to workflow and automation capabilities to adapt to growing demand and the rapidly changing workspace model.
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
Wearable devices have come of age. The primary applications of wearables so far have been "the Quantified Self" or the tracking of one's fitness and health status. We propose the evolution of wearables into social and emotional communication devices. Our BE(tm) sensor uses light to visualize the skin conductance response. Our sensors are very inexpensive and can be massively distributed to audiences or groups of any size, in order to gauge reactions to performances, video, or any kind of presentation. In her session at @ThingsExpo, Jocelyn Scheirer, CEO & Founder of Bionolux, will discuss ho...
Cloud data governance was previously an avoided function when cloud deployments were relatively small. With the rapid adoption in public cloud – both rogue and sanctioned, it’s not uncommon to find regulated data dumped into public cloud and unprotected. This is why enterprises and cloud providers alike need to embrace a cloud data governance function and map policies, processes and technology controls accordingly. In her session at 15th Cloud Expo, Evelyn de Souza, Data Privacy and Compliance Strategy Leader at Cisco Systems, will focus on how to set up a cloud data governance program and s...
As organizations shift toward IT-as-a-service models, the need for managing and protecting data residing across physical, virtual, and now cloud environments grows with it. CommVault can ensure protection &E-Discovery of your data – whether in a private cloud, a Service Provider delivered public cloud, or a hybrid cloud environment – across the heterogeneous enterprise. In his session at 16th Cloud Expo, Randy De Meno, Chief Technologist - Windows Products and Microsoft Partnerships, will discuss how to cut costs, scale easily, and unleash insight with CommVault Simpana software, the only si...
Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 16th Cloud Expo at the Javits Center in New York June 9-11 will find fresh new content in a new track called PaaS | Containers & Microservices Containers are not being considered for the first time by the cloud community, but a current era of re-consideration has pushed them to the top of the cloud agenda. With the launch of Docker's initial release in March of 2013, interest was revved up several notches. Then late last...
Roberto Medrano, Executive Vice President at SOA Software, had reached 30,000 page views on his home page - http://RobertoMedrano.SYS-CON.com/ - on the SYS-CON family of online magazines, which includes Cloud Computing Journal, Internet of Things Journal, Big Data Journal, and SOA World Magazine. He is a recognized executive in the information technology fields of SOA, internet security, governance, and compliance. He has extensive experience with both start-ups and large companies, having been involved at the beginning of four IT industries: EDA, Open Systems, Computer Security and now SOA.
HP and Aruba Networks on Monday announced a definitive agreement for HP to acquire Aruba, a provider of next-generation network access solutions for the mobile enterprise, for $24.67 per share in cash. The equity value of the transaction is approximately $3.0 billion, and net of cash and debt approximately $2.7 billion. Both companies' boards of directors have approved the deal. "Enterprises are facing a mobile-first world and are looking for solutions that help them transition legacy investments to the new style of IT," said Meg Whitman, Chairman, President and Chief Executive Officer of HP...
The industrial software market has treated data with the mentality of “collect everything now, worry about how to use it later.” We now find ourselves buried in data, with the pervasive connectivity of the (Industrial) Internet of Things only piling on more numbers. There’s too much data and not enough information. In his session at @ThingsExpo, Bob Gates, Global Marketing Director, GE’s Intelligent Platforms business, to discuss how realizing the power of IoT, software developers are now focused on understanding how industrial data can create intelligence for industrial operations. Imagine ...
Operational Hadoop and the Lambda Architecture for Streaming Data Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, representing a model of how to analyze rea...
SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.
The explosion of connected devices / sensors is creating an ever-expanding set of new and valuable data. In parallel the emerging capability of Big Data technologies to store, access, analyze, and react to this data is producing changes in business models under the umbrella of the Internet of Things (IoT). In particular within the Insurance industry, IoT appears positioned to enable deep changes by altering relationships between insurers, distributors, and the insured. In his session at @ThingsExpo, Michael Sick, a Senior Manager and Big Data Architect within Ernst and Young's Financial Servi...
SYS-CON Events announced today that Open Data Centers (ODC), a carrier-neutral colocation provider, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Open Data Centers is a carrier-neutral data center operator in New Jersey and New York City offering alternative connectivity options for carriers, service providers and enterprise customers.
The explosion of connected devices / sensors is creating an ever-expanding set of new and valuable data. In parallel the emerging capability of Big Data technologies to store, access, analyze, and react to this data is producing changes in business models under the umbrella of the Internet of Things (IoT). In particular within the Insurance industry, IoT appears positioned to enable deep changes by altering relationships between insurers, distributors, and the insured. In his session at @ThingsExpo, Michael Sick, a Senior Manager and Big Data Architect within Ernst and Young's Financial Servi...
PubNub on Monday has announced that it is partnering with IBM to bring its sophisticated real-time data streaming and messaging capabilities to Bluemix, IBM’s cloud development platform. “Today’s app and connected devices require an always-on connection, but building a secure, scalable solution from the ground up is time consuming, resource intensive, and error-prone,” said Todd Greene, CEO of PubNub. “PubNub enables web, mobile and IoT developers building apps on IBM Bluemix to quickly add scalable realtime functionality with minimal effort and cost.”
Sensor-enabled things are becoming more commonplace, precursors to a larger and more complex framework that most consider the ultimate promise of the IoT: things connecting, interacting, sharing, storing, and over time perhaps learning and predicting based on habits, behaviors, location, preferences, purchases and more. In his session at @ThingsExpo, Tom Wesselman, Director of Communications Ecosystem Architecture at Plantronics, will examine the still nascent IoT as it is coalescing, including what it is today, what it might ultimately be, the role of wearable tech, and technology gaps stil...