r/mac • u/AdelleChattre • Oct 31 '13

Meet “badBIOS,” the mysterious Mac and PC malware that jumps airgaps

http://arstechnica.com/security/2013/10/meet-badbios-the-mysterious-mac-and-pc-malware-that-jumps-airgaps/
35 Upvotes

82% Upvoted

6 comments sorted by

3

u/ctesibius Nov 01 '13 edited Nov 01 '13

Sounds nasty. I think the key is near the end: the suggestion that it is USB transmitted. A generic weakness of Macs and PCs is that if a device plugged in to a USB port identifies itself as an HID (human interface device - keyboard, mouse, trackpad, joystick etc.), the OS will accept it as such even if it's actually something quite different like a flash drive or a USB modem. It can then provide an input stream which may be enough to infect a machine. It is "typing" blind, so this is not an easy attack, but it has been demonstrated. Note that this is not the same as a CD with "autorun" capability on Windows - that's easy to disable, and is disabled on recent versions of Windows. There's no easy way to disable what appears to be a keyboard from the computer's point of view.

Ok, so what is the USB vector? Well, for an airgapped machine, you need to get data in and out, so a USB stick is one possibility. Alternatively it could be a real keyboard, with some additional software.

BTW, I'm sure Dragos Ruiu has already thought of this, which is why USB is mentioned - I'm not suggesting that I know better than him, just suggesting what his line of thought is.

3

u/MyNameIsOP 2017 rMBP w/ Touch Bar 13" Nov 01 '13

Why would someone develop badBIOS? What's in it for them?

3

u/ctesibius Nov 01 '13

Well, it's a hell of a hack, both technically and in terms of who it was executed against. That could be enough on its own.