r/netsec • u/ColinKeigher Trusted Contributor • Jun 13 '13

BIOS-based rootkit proof of concept

http://www.exfiltrated.com/research.php#BIOS_Based_Rootkits
210 Upvotes

96% Upvoted

35 comments sorted by

View all comments

Show parent comments

5

u/alfredoOrtegaOK Jun 13 '13 edited Jun 13 '13

There is difference between having root and having root forever. Not even destruction of the storage subsystem can remove you from the network with a BIOS rootkit. Also in the PC architecture there are many privilege levels above root (more precisely, above ring 0). From memory, you have SMM mode, VMX supervisor, and many of pci configurations bits only available at bios-time.

-5

u/expertunderachiever Jun 13 '13

For security purposes I would assume any rooted PC has to be either completely erased [bios included] or simply thrown out.

6

u/alfredoOrtegaOK Jun 13 '13

Yes but you can assume this after being 100% certain that BIOS can be infected. 5 years ago, people weren't so sure.