Into the unknown: how to detect BIOS-level attackers (slides), and Copernicus (free program)

MrBrian · Oct 2, 2014

From https://www.virusbtn.com/conference/vb2014/abstracts/LM6-Kovah-etal.xml:

What do you know about BIOS vulnerabilities & attackers? Do you know that current data suggests that more than half of enterprise BIOSes in the wild have known vulnerabilities going unpatched? Do you know which vendors have patches that fix issues, and which vendors don't? Do you know how many exploits have come out in the past year that allow attackers to bypass all security features and take control of a BIOS and thus defeat all security software? Do you know that state-sponsored attackers attack at the BIOS level but have never been caught by the AV industry?

This talk will shed some light on the largely out-of-sight, out-of-mind problem of security at the lowest level of the platform. But it will suggest actions that can be taken immediately to improve BIOS-level malware detection by leveraging free tools for Windows and *nix platforms. These tools and techniques have significantly matured over the past year, and are now appropriate for incorporation into COTS security products. This talk will also show how malware analysts with existing Windows executable static analysis knowledge can be taught a little bit of BIOS-specific information in order to become BIOS malware analysts too.
Click to expand...

From http://www.mitre.org/capabilities/c...og/copernicus-question-your-assumptions-about:

At this stage in our research, we offer [...] the Copernicus code, which dumps BIOSes and a Python script that analyzes the dumps for differences and inspects BIOS writability configuration.
Click to expand...

MrBrian · Oct 2, 2014

Copernicus 2

MrBrian · Oct 2, 2014

Slides "PC Firmware Attacks, Copernicus, and You" - hxxp://conference.auscert.org.au/gfx/speakers/presentation-slides/1425_xeno_kovah.pdf .

MrBrian · Oct 2, 2014

Related: BIOS and other firmware security

MrBrian · Oct 4, 2014

I tried Copernicus v1 Aug 7 2014. The BIOS dump worked fine. I have no reference BIOS to compare it with though. I always got error "No valid CSV files found" when I ran Protections.py.

Some might find Copernicus tutorial hxxp://alexandreborgesbrazil.files.wordpress.com/2014/04/malware_attack_bios.pdf useful.

MrBrian · Oct 4, 2014

By the way, Python doesn't need to be installed to do the dump.

MrBrian · Oct 5, 2014

If anyone's wondering why I used Copernicus v1 instead of Copernicus v2, it's because my computer doesn't have a TPM chip, which Copernicus v2 requires if I am not mistaken. It's probably better to use Copernicus v2 than Copernicus v1 because Copernicus v1 can be induced to output lies, as a paper in the link in post #2 mentions.

If anyone's interested in using this thread as a public repository of BIOS hash values, please list your computer model, BIOS version, and BIOS hash.

Log in or Sign up

Into the unknown: how to detect BIOS-level attackers (slides), and Copernicus (free program)

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Log in or Sign up

Into the unknown: how to detect BIOS-level attackers (slides), and Copernicus (free program)

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Useful Searches