3 ms·

Would it be possible to infect device firmware? If this guy's airgapped computers keep getting infected, assuming he's smart enough to not plug a USB drive into

• dublinben 13y ago
  According to the article, he plugged a (presumably) infected USB drive into the fresh computer, providing the most likely means of infection.
  • rthomas6 13y ago
    >"We had an air-gapped computer that just had its [firmware] BIOS reflashed, a fresh disk drive installed, and zero data on it, installed from a Windows system CD," Ruiu said. "At one point, we were editing some of the components and our registry editor got disabled. It was like: wait a minute, how can that happen? How can the machine react and attack the software that we're using to attack it? This is an air-gapped machine and all of the sudden the search function in the registry editor stopped working when we were using it to search for their keys." I read this as the computer being infected without a USB plugged into it. "Air-gapped" would mean no USB, right?
    • nknighthb 13y ago
      > "Air-gapped" would mean no USB, right? No, it means air-gapped. Traditionally this just meant no wires to other computers (and an autonomous power source if you're extra paranoid). Today of course it more broadly means no direct communication with another computer, including things like WiFi or Bluetooth. External media has always been used to transfer data between air-gapped systems, and it's always been a weakness. USB drives are just smarter than older forms of external media, posing a greater potential threat.