BIOS vulnerability that hacker can embed malware within 2 minutes will be discovered

ByScott Vandehey

It stands for Basic Input / Output SystemBIOS(BIOS) is a program installed in the ROM on the motherboard, and it manages and controls the keyboard, mouse, CPU, etc. before the OS starts up. A security investigator has revealed a vulnerability that makes the BIOS hackable in less than two minutes.

Noobs can pwn world's most popular BIOSes in two minutes • The Register
http://www.theregister.co.uk/2015/03/19/cansecwest_talk_bioses_hack/

Hacking BIOS Chips Is not Just the NSA's Domain Anymore | WIRED
http://www.wired.com/2015/03/researchers-uncover-way-hack-bios-undermine-secure-operating-systems/

Although the BIOS was a substitute that could not be hacked unless it was an advanced hacking technology like NSA or an institution with facilities, the organization that is investigating the security of the BIOSLegbaCoreAccording to Mr. Xeno Kovah and Corey Kallenberg, researchers at the time said that with the vulnerability discovered this time, even if you do not have much technology, anyone can attack you with only a certain knowledge of hacking It is that.

ByHenrique Pinto

The BIOS is a program necessary for booting the PC and loading the OS, there is not much in itself to scan with normal antivirus software, and it is difficult for the user to discover once infected with malware . Besides, the BIOS is a program that runs before PC startup, so malware is not deleted even if the OS is initialized.

Mr. Kovah and Mr. Kallenberg are going to demonstrate their survey, the IT security event held from 20th March 20 th 2015 "CanSecWest 2015"To demonstrate the danger of the BIOS and demonstrated that attacks can exploit BIOS vulnerabilities against Acer, MSI, HP, ASUS, Gigabyte PCs among them. In the demonstration, I infected the BIOS of each PC with malware and surprisingly it took about 1 hour to attack.

ByChristophe Verdier

Hackers are expected to send malware using two attack patterns: sending attack codes via phishing mail or physically accessing the system. If a hacker can access the system of the user's PC, it takes less than 2 minutes to send the malware. The vulnerability discovered by Kovah and others exists in BIOS installed in most PCs around the world. Since most of the general users do not even know the existence of the BIOS, even if a patch for correcting the vulnerability is distributed, the possibility that the distributed patch is applied will be reduced, further complicating the problem It seems to be doing.