S
Skybuck The Destroyer
Hello,
The old bios chip seems to be working.
However the bios chip might be corrupted or infected with a bios
virus ?!
So I want to investigate the bios chip.
What is the best way to completely backup the BIOS and compare it with
other versions ?
So far I can think of this method, but is it thorough enough ?
1. Use bootdisk and afudos tool to backup the bios to a rom image.
2. Download/find corresponding bios version from the internet or
harddisk (could ofcourse still be modified but unlikely... best to
redownload it to make absolutely sure
though maybe the internet
bios version is already changed ! haha, so compare to disk is also
good ! =D)
3. BINARY COMPARE ROM IMAGES/FILES.
Then see if there are any differences...
This is a simple and short test.
However I have seen people write about "protected" areas of the bios
chip...
Do these "protected" area's exist... are they backed up as well ?
Can a virus penetrate these "protected" area's ?
What about the remaining unused memory ?
Can virus hide there ? HMMM ?!?
Ofcourse a little bit of the bios would have to be changed for the
virus to jump to unused memory... so it would probably still be
detected.
And finally:
What tools are available on the internet to investigate bios rom
images/file more thoroughly... maybe even at the command/programming
level ?!
Having a look at it could be interesting anyway... and the binary
compare seems a really smart way to check/make sure it wasn't altered.
However I have heard somebody tell a story about a virus which shortly
****ed up your computer... and then after a while it would completely
VANISH.... it would simply restore everything back to normal.
So that all evidence would be gone ?!
By the time you come at the store with "dead motherboard" it would
suddenly be alive again =D
Funny story isn't it.
Well for me that's ofcourse not the case... my old motherboard is as
dead as it can be... confirmed in other post/thread/testings.
YES.
AND TO ALL VIRUS WRITES I SAY:
1. PLEASE DON'T WRITE VIRUSSES THAT'S BAD AND NASTY AND NOT NICE !
2. PLEASE DON'T USE THIS TECHNIQUE TO VANISH. ALWAYS LEAVE A TRACE SO
YOU WILL BE CAUGHT THAT'S GOOD FOR YOU AND ME AND THE WORLD =D
3. AND ADVICE TO HARDWARE MANUFACTURERS:
BUILD IN A MODIFICATION DETECTION METHOD WHICH CAN'T BE RESET.
FOR EXAMPLE:
BUILD IN A COUNTER WHICH KEEPS TRACK OF THE NUMBER OF MODIFICATIONS to
the BIOS CHIP.
THIS COUNTER SHOULD BE IMPOSSIBLE TO RESET.
WHEN THE USER FLASHES THE NEW COUNTER VALUE IS STORED TO DISK OR
SOMETHING.
Then later... if the counter value does not match the counter value on
disk... or on a piece of paper for all I care... then the USER KNOWS
the BIOS CHIP WAS MODIFIED WITHOUT HIS CONSENT !
SOMETHING ELSE CHANGED IT !
YES THE COUNTER IDEA IS GOOD IDEA TO CATCH BIOS VIRUSSES AND OTHER
UNALLOWED BIOS CHANGES ! HA-HA.
It's a nice start to improve BIOS SECURITY
Bye,
Bye,
Skybuck.
The old bios chip seems to be working.
However the bios chip might be corrupted or infected with a bios
virus ?!
So I want to investigate the bios chip.
What is the best way to completely backup the BIOS and compare it with
other versions ?
So far I can think of this method, but is it thorough enough ?
1. Use bootdisk and afudos tool to backup the bios to a rom image.
2. Download/find corresponding bios version from the internet or
harddisk (could ofcourse still be modified but unlikely... best to
redownload it to make absolutely sure
though maybe the internetbios version is already changed ! haha, so compare to disk is also
good ! =D)
3. BINARY COMPARE ROM IMAGES/FILES.
Then see if there are any differences...
This is a simple and short test.
However I have seen people write about "protected" areas of the bios
chip...
Do these "protected" area's exist... are they backed up as well ?
Can a virus penetrate these "protected" area's ?
What about the remaining unused memory ?
Can virus hide there ? HMMM ?!?
Ofcourse a little bit of the bios would have to be changed for the
virus to jump to unused memory... so it would probably still be
detected.
And finally:
What tools are available on the internet to investigate bios rom
images/file more thoroughly... maybe even at the command/programming
level ?!
Having a look at it could be interesting anyway... and the binary
compare seems a really smart way to check/make sure it wasn't altered.
However I have heard somebody tell a story about a virus which shortly
****ed up your computer... and then after a while it would completely
VANISH.... it would simply restore everything back to normal.
So that all evidence would be gone ?!
By the time you come at the store with "dead motherboard" it would
suddenly be alive again =D
Funny story isn't it.
Well for me that's ofcourse not the case... my old motherboard is as
dead as it can be... confirmed in other post/thread/testings.
YES.
AND TO ALL VIRUS WRITES I SAY:
1. PLEASE DON'T WRITE VIRUSSES THAT'S BAD AND NASTY AND NOT NICE !
2. PLEASE DON'T USE THIS TECHNIQUE TO VANISH. ALWAYS LEAVE A TRACE SO
YOU WILL BE CAUGHT THAT'S GOOD FOR YOU AND ME AND THE WORLD =D
3. AND ADVICE TO HARDWARE MANUFACTURERS:
BUILD IN A MODIFICATION DETECTION METHOD WHICH CAN'T BE RESET.
FOR EXAMPLE:
BUILD IN A COUNTER WHICH KEEPS TRACK OF THE NUMBER OF MODIFICATIONS to
the BIOS CHIP.
THIS COUNTER SHOULD BE IMPOSSIBLE TO RESET.
WHEN THE USER FLASHES THE NEW COUNTER VALUE IS STORED TO DISK OR
SOMETHING.
Then later... if the counter value does not match the counter value on
disk... or on a piece of paper for all I care... then the USER KNOWS
the BIOS CHIP WAS MODIFIED WITHOUT HIS CONSENT !
SOMETHING ELSE CHANGED IT !
YES THE COUNTER IDEA IS GOOD IDEA TO CATCH BIOS VIRUSSES AND OTHER
UNALLOWED BIOS CHANGES ! HA-HA.
It's a nice start to improve BIOS SECURITY
Bye,
Bye,
Skybuck.