Comment by EFruit | Hacker News Reader

Comment by EFruit | Hacker News Reader

So wait, it's a BIOS virus that covers the platforms he tested (multiple BIOSs to exploit/patch)...

that can communicate via Sound (Requires DSP)...

that can defend itself against the registry editor (Deep integration to the OS, for at least windows, linux/OSX noted as well)...

that can alter data...

that can infect network cards (implied in the article)...

that can possibly use the power system to communicate (Ok, on a laptop, that might be possible. Otherwise, PSUs aren't completely isolated from the computing system's logic?)...

that all still fits within a BIOS chip? Either BIOSs are complex (read space-intensive) enough to stop being Basic, or they can fit this AND a functioning BIOS in to a payload that would be delivered by sound, USB, network cards...

Can it modulate the fans to transmit data too? Or change the screen brightness faster than the human eye can see, but can be detected with cameras? How about using the Wifi, HDD activity, sound mute, caps lock, numlock, scroll lock and power indicators to transmit?

How about opening and closing the HDD to transmit data?

I can't agree more with MacsHeadroom's assertion that this is a situation where the simplest explanation wins.

Not to mention I REALLY don't want this kind of thing to exist...

EDIT: Added fans paragraph

If these were all EFI/UEFI machines, there is a lot more code in these preboot EFI environments than one expects. Room enough to hide this kind of payload.

I could expect ONLY the DSP, ONLY the windows-individual portion, maybe 4 or 5 BIOS exploits and maybe 2 or 3 BIOS patches, about the same for Ethernet cards, maybe the CD controller, maybe 1 or two different USB firmware exploits and patches, maybe the entire PSU manipulation logic

but ALL of that? In the BIOS?

(I'd like to point out I am nowhere near the caliber of the man who's supposedly experiencing all of this. I do not know the true size of any of the aforementioned payload.)

With UEFI/EFI it's pretty plausible that you can load additional code at runtime from elsewhere even outside of the large space available for UEFI/EFI itself. Some versions even self contain quick booting minimal environments that contain web browsers and such.

I had a motherboard in the 90s that had a mouse-driven GUI for its BIOS configuration. "BIOS" hasn't been "basic" in decades.

Well, BIOSes these days are all the same anyway (Award/Phoenix), and no one gives a fk about BIOS code safety. Even the "anti-thievery" measure of permanent security codes (unlockable by manufacturer only) is moot, as you can reverse-engineer BIOS updates and get the code from them.

And I would not rely on BIOS code be security-audited in ANY way! Especially not the part of the code dealing with USB. Low-level as it may be, I bet there exist buffer overflow or other vulnerabilities in USB protocol stacks.

From TFA: "he suspects badBIOS is only the initial module of a multi-staged payload"

I understand, but from my reading of the article, it looks like all of this is the inital badBIOS module

But on the topic of modular malware, what would the initial discovery of Flame look like, if it were still in-progress after 3 years? Would it or would it not seem like this? It's got odd transmission methods, and the possibility of more to come. But if deleting data, self protection, and propogation aren't the attacks, then what are?

Reply on news.ycombinator.com