3 ms·
Well. Microcode updates are lost on reboot, and they can only be applied from privileged code. Which means you'll have to be able to slip rogue code into the BI
by 0x0 12y ago
Well. Microcode updates are lost on reboot, and they can only be applied from privileged code. Which means you'll have to be able to slip rogue code into the BIOS or the kernel, at which point you already have full control. The "negative ring" levels of code (SMI, etc) are quite powerful already.
But a trojanized microcode update file inside an otherwise regular BIOS would be a nice hiding spot, hard to detect and analyze, at least for anyone outside Intel.
- AlyssaRowan 12y agoOr you could just use SMM or IPMI.
- sillysaurus3 12y agoUse those how? Would you go into detail?
- amluto 12y agoSee, for example: http://www.eecs.ucf.edu/%7Eczou/research/SMM-Rootkits-Securecom08.pdf http://www.eecs.ucf.edu/%7Eczou/research/SMM-Rootkits-Secure... If you're an OS, then you need some kind of exploit to update SMM code. But if you're the BIOS, then you have complete control over what happens in SMM mode.