Printable View
Hello everyone,
I just started this topic in a reply to a post I started but I also wanted to put it here so some people who have more knowledge of viruses can respond.
Here is the quesiton:
You can update bios through a program run from a floppy disk,
WHY can a virus not do the same.
If anyone could explain to me how a virus cannot change/alter/erase bios I would love to know, so I can put this nagging little question out of my head.
Thanx
That would be pretty tough...
A BIOS update has to be done by a program that flashes the BIOS.
This happens before any memory or hard disk is accessed.
Since the memory dumps everything after it looses power... there is no way for a virus to infect the BIOS.
Another thing would be... how would a virus writer know which BIOS version a user is running, and which program that they have to use to flash the BIOS and then how to get the user to put the virus on the disk, and infect theirselves.
So... I think the first place a virus writer would have an opportunity to infect would be the MBR (master boot record). Which can be easily fixed by a fdisk /MBR
I read this a few times... and thought about it for a minute, and a virus attacking the BIOS sounded really familiar.... Then I remembered why... Now this is a little dated but it proves it can happy...
I'm sure everyone remembers CIH. Well one of the points of that virus was that it could kill your BIOS if you had a Flashable BIOS on the original Pentiums..... It happened to a friend of mine and it wasn't pretty... ended up costing him a new motherboard....
This page doesn't give detailed information on how it works, but it gives you some details on CIH and what exactly it did.... I'm sure googling for CIH +BIOS or BIOS +Virus will give you more results and a little more detail. Anyways.. here's the page:
http://www.stiller.com/cih.htm
HTRegz:
Wow. I had no idea that that would be possible... crazy.
I'm going to have to do a little more research on this one... you've me pondering....
Im glad you responded to this Phish as you seem to be one of the bright bulbs around here,
Ok thats enough kissing your kilt, im gonna get to the point now,
All of your points are valid, but I have never heard disscussions (sp) over "bios Security" and that alone makes it in my mind an open playground for hackers. What I mean is that by everyone assumeing that bios is 99.9% secure, no one thinks to really dig into ways that it could be attacked. Knowing what I know about hackers (which is very little) I have to think that any hacker/virus writer would probe bios for every little exploit possiable. As you said before it would be really hard but is it Impossiable?
If someone was to write a virus for bios that could cause damage, how would you know its a virus? Are there virus scanners for bios? No. Is there an auto protect feature in NAV2003 for bios protection? No. Pretty much if a hacker nailed bios there would be no way to tell that it was hacked. If you destroyed bios there is no fingerprint left behind.
This may sound WAY outta left field but for the sake of keeping this post going tell me if this could happen...
A virus is written that alters windows power management. When you shut your computer down, the virus alters the closeing of windows to tell the power supply (yes i know power supplies are stupid boxes that do not accept commands from windows, but the motherboard is not) to maintain power to the RAM. Enough to keep what ever was last there, still there.
Now this is a COMPLETE theory but I would like to know if it holds any water At all. BTW sorry for the crummy spelling
blunuke420:
If you are concerned about a file (virus) affecting your bios.. the best thing to do is pull your case open and find the BIOS Write-Protect Jumper... As long as your BIOS is Write-Proected.. nothing is going to change it. It's like Write-Protecting a disk.. you can't put any files on it..
As for BIOS Security.. that's usually when someone has physical access to the machine. You don't want the users in your company accessing the BIOS and changing the boot order from C,A to A,C.. Then they could boot whatever they wanted off a floppy and go wild with it.
so if your bios is write protected at the jumper there is NO way for it to be altered, even with a flash program?
Nope... can't be done....
That's why the instructions when flashing your BIOS will say make sure the jumper is removed.... or on.. depending on your MoBo setup
Thanks... but as HTRegz pointed out...Quote:
Im glad you responded to this Phish as you seem to be one of the bright bulbs around here,
Ok thats enough kissing your kilt, im gonna get to the point now,
We went over that in an OS class I took... and my professor said that it wasn't possible... but who said professors are always correct? They are human just like you and I...Quote:
Well one of the points of that virus was that it could kill your BIOS if you had a Flashable BIOS on the original Pentiums..... It happened to a friend of mine and it wasn't pretty... ended up costing him a new motherboard.... http://www.stiller.com/cih.htm
I remember the CIH cost me a mobo (I had a PII 300 at that time)
Well I did like the fact that my new mobo DID have a jumper for flashing and also it had faster mem support..
I think for those MOBO's you could even flash the BIOS with your own stuff..
and even for some newer mobo's..
the only trouble is: evry mobo has different bios (for the biggest part they are the same but still)..
so the virus would be asus or msi only.. if you catch my drift here..
There is a set of commands for flashing the bios. This set of commands is deliberately complicated (so that nothing does it by accident), and different on different motherboards (to reduce the probability that you will flash it with the wrong one).
However, if a virus knows the right commands for the specific motherboard, it can reflash the bios which in some cases renders the machine entirely unusable (for ever)
As others have noted, an example of one which did this was the "Chernobyl" virus. At our company, 2 machines were fried by it (and several others had their hard discs wiped)
Some motherboards have a low-level reflash procedure which allows the bios to be reflashed without being able to boot (You hold a key down on the keyboard, having inserted a specially formatted floppy). This recovers a fried bios.
I'm not sure how effective something like the CIH virus would be today.
As has been pointed out, some MB have a jumper you can set to prevent an autamatic reflash.
Also, on some BIOS you will find an option to set an option called 'BIOS Flash Protection' under 'Advanced BIOS Features', which will prompt you if the BIOS is being reflashed.
If you are running WinXP with an NTFS file system, the BIOS reflash program/virus normally needs to run in native DOS mode, as it does not understand NTFS.
Not only does every vendor and every type of motherboard have their own type of bios, the way in which this flash memory actually gets flashed also differs from each other.
The reason all those bios flash programs need to be booted from DOS is actually quite simple. When using a DOS bootdisk there are usually no memory managers, no hardware drivers and no applications running. This will make flashing your bios safer because none of these things can get in the way when flashing.
Ok,
Virus that attacks a Computers BIOS..
Well some systems I have encountered over the past few years I have never had the time to find the name of the Mal-ware that has caused the problems.. that is after elliminating the user and random hardware probs as the cause..
1/ 2 cases different brands of sock 370 mobo's - No P.O.S.T .. Error message.. Had to auto script a reflash of BIOS..
2/ 15 to 20 cases various Slot1/socket 370 mobo's - Unable to reinstall OS or/and CD ROM not reading CD or/and cd-Draw not obeying commands - Had to Reset CMOS memory ie reset the Bios settings..
3/ 6 or 7 systems with similar to above symptoms - Had to Flash the BIOS to Fix.
With any machine that has been infected with recent virii a Good ol clearing/reset of the CMOS is a good precaution to prevent "hidden" nasties.. And why do I follow this path?
How many of the motherboards built in the last 4-5 years that you know of came with a windows/dos based Cmos/bios utility? OK and how many of those had a utility that allowed internet/windows BIOS updateing?..
Your BIOS EEPROM and RAM occupy the lower areas of the systems memory map (I am assuming little has changed in 10 years), your operating system is able to interogate this area as well as write to some areas (clock settings, etc), so a virus would writer will have no problems identifing the bios type, and perhaps leave a package in the unused area of the CMOS.
Further to this, a Mal-ware code (read Virus, mal-ware script etc) would identify the Bios type and with a basic libary of Chip types, Bios manufacturers and MoBo manufactures, would then successfully damage the BIOS Software and or store further damaging code.
To back this up.. check out old DOS utilities for backing up and restoring a systems CMOS.. some would reeport how much free memory in the CMOS (couldn't see a use for it at the time.. not very forward thinking was I)
I hope I made sence..
Cheers
It seems to me that if you do have a flash BIOS it could be overwritten. Much like a router configuration can be remotely flashed to NVRAM. I understand that there are some hoops that a BIOS virus would have to jump through and would not be very effective in spreading or doing much more than denying you access to your computer for awhile, but as far as the idea of BIOS virii, I am sure that given the right circumstances it could happen.
As far a security, jumpers would be the best form, but also BIOS passwords could function as a decent form of security.
The fact that once the virus infects your system you are denied even the C prompt kinda puts a wrench in its ability to spread, this could explain why there is not much focus on it.
It seems to me that if you do have a flash BIOS it could be overwritten. Much like a router configuration can be remotely flashed to NVRAM. I understand that there are some hoops that a BIOS virus would have to jump through and would not be very effective in spreading or doing much more than denying you access to your computer for awhile, but as far as the idea of BIOS virii, I am sure that given the right circumstances it could happen.
As far a security, jumpers would be the best form, but also BIOS passwords could function as a decent form of security.
The fact that once the virus infects your system you are denied even the C prompt kinda puts a wrench in its ability to spread, this could explain why there is not much focus on it.
I have a Dual BIOS, and you can get BIOS saviours that can make a copy of your BIOS straight to a secondary chip, and then re-load it from there if something goes wrong...
oh well...I don't think CIH would have any affect these days, New hardware is too advanced and to well protected....plus, if you wheren't running an Anti-virus, sucks to be you.
- Noia
The Cmos password will not keep your bios from beeing flashed by a programm, it will only keep people out of the system.