3 ms·
Isn't the question whether a firmware / BIOS / microcode invasion is detectable given that the firmware has been taken over? The answer being probably not. Exce
by creer 2y ago
Isn't the question whether a firmware / BIOS / microcode invasion is detectable given that the firmware has been taken over? The answer being probably not. Except for reading the flash memory at the chip level which is most likely not provided off the shelf by the system. To be repaired, the problem needs to be noticed first.
- mjg59 2y agoPlatform Secure Boot will measure the firmware into the TPM, so if an attacker modifies the firmware then yes, it'll be detectable. The microcode is signed so any attempt to modify it will simply result in the CPU booting with its ROM-based microcode.
- creer 2y agoWe'll get more detail tomorrow from Defcon - as to where the flaw is located. Apparently something in that neighborhood allows persistence - and for the attack not to be reported.
- mjg59 2y agoThe shape of the flaw seems pretty clearly described in the abstract - it's the ability to either modify the contents of the locked SMM memory regions (and so get arbitrary code execution there), or trigger SMM execution of code outside the SMRAM region. Either way, SMM vulnerabilities aren't new, and the capabilities associated with them are pretty well understood - what's different here is that the vulnerability is apparently in the CPU rather than the firmware, and so everyone's affected no matter who their firmware vendor is.