Flashing BIOS/UEFI without loading BIOS/UEFI

MarkJFernandes

Hello,

I have an Acer laptop that I suspect may have malware infected in its BIOS/UEFI firmware. It certainly appears to have been hacked somehow, and since I have not taken care to secure physically the machine when away from it, I believe that I can't rule out the possibility of malware being in the BIOS/UEFI firmware.

I don't want to turn on the machine in its present state, as if there is malware in the BIOS/UEFI firmware, this would pose a security risk (since the BIOS/UEFI is the first thing to run). So firmware flashing utilities that require an OS to be running, or even just the BIOS/UEFI to have been initially run, appear to be useless so long as the BIOS/UEFI firmware is in its current state.

What I effectively want to do is treat the laptop as though it has been 'bricked' at the BIOS/UEFI firmware level, and then from that starting point, to reinstall the firmware.

Reading on the internet, it appears there is a chance that I might be able to reinstall the firmware without running the present BIOS/UEFI (that could have malware in its firmware) by using something known as a BIOS Recovery jumper. USB devices for flashing and reprogramming BIOS/UEFI firmware also look as though they might be useful for my circumstances.

------------------------------------------------------------------------

Can anyone at all help with this? I also need to know of a secure site from which I can download any required files.

Thanks,

Edited the content to hide personal information

Laptop spec.:Acer Extensa 2511 laptop

MarkJFernandes

billsey said:

Yeah, Intel AX201 WiFi 6/Bluetooth 5.0 IIRC. The issue with rewriting both the CMOS and EFI sections is the signing needed for them to show as valid. MS assigns those to tested loads so it's very unlikely that a bad guy will get it right. The work around for that is for the bad guy to disable that functionality in their version and basically replace everything with the custom version. Needless to say a lot of that requires knowledge of the hardware involved, so a version for each model type. It's always possible that someone could do that, ut as I was saying before it's very unlikely for someone to do it unless there's a big potential for gain at the other end. Malware isn't typically created just to see it spread, it's created in order to bring some type of gain for the creator. That might be access to private data for resale, such as credit card info and passwords, access to the hardware in order to form a portion of a botnet, so they can extort funds from website owners, or encryption of data to extort fund from the machine owner. Each of those require some threshold of potential return on investment to offset the effort used in creating the malware package. For something as targeted and detailed as you are describing there would have to be a significant return... Now you might have a large enough net worth or have access to sensitive enough data, but if so you'd be more likely to junk this system and get a new one than to be trying to fix it yourself. I think it much more likely to have been infected with a typical key logger/remote access malware package in the OS than a BIOS attack.

Which antivirus are you running? Have you tried running a scan with an alternate such as Malwarebytes?

Hello billsey, thanks for your insights.

I was running Norton Security. Previously, I think I recall using Malwarebytes. I'm not switching the computer on with the system drive attached because of the chance of malware being in the BIOS/UEFI.

Ideally, I would junk this system, but I'm on too much of a tight budget at the moment. Plus, it is worthwhile to learn how to render such an insecure system secure, just in case I need to do the same again, as well as to help co-workers in regard to securing their systems.

Regarding your analysis of the cost-to-benefit aspect of hacking, I agree with it in part. However, you must take into account the re-usability of attacks. When you say you need to know about the hardware, I'm presuming you mean that you need to know about the BIOS hardware. Given that BIOS hardware is repeated over many computers, such attacks can be highly reusable. Whilst there may not be an advantage in putting in the work to construct the attack just for me, the effort can be made for all the targets in one go, and then to attack me specifically doesn't cost much. There is also the aspect of corruption to consider, in the sense that GCHQ or the CIA may develop the attacks simply because they have the time and money, and then due to corruption, the attacks are leaked out to criminal organisations (such as may happen during the collapse of an empire)—the initial work to develop the attack was never tied to attacking me personally, but ultimately it leads to attacking me personally. One final thing to consider, is that we probably mostly don't have information about many successful attacks. Even if an organisation discovered that they had been attacked, they may feel compelled to cover it up as it can make them look bad.

It's also worthwhile acknowledging that the engineering and science know-how for constructing such attacks is being taught and can also be learnt through self-study of free resources, in poorer under-developed economies (such as in India, which in fact is well known for its corruption). Therefore, it may not be as costly as you are making it out to be.


Thanks,

Edited the content to hide personal information