DeepSec 2014 Talk: A Myth or Reality – BIOS-based Hypervisor Threat
Backdoors are devious. Usually you have to look for them since someone has hidden or „forgotten“ them. Plus backdoors are very fashionable these days. You should definitely get one or more. Software is (very) easy to inspect for any rear entrances. Even if you don’t have access to the source code, you can deconstruct the bytes and eventually look for suspicious parts of the code. When it comes to hardware, things might get complicated. Accessing code stored in hardware can be complex. Besides it isn’t always clear which one of the little black chips holds the real code you are looking for. Since all of our devices we use every days runs on little black chips (the colour doesn’t matter, really), everyone with trust issues should make sure that control of these devices is in the right hands – or bytes.
DeepSec 2014 features a talk where BIOS-based hypervisors are discussed. There is ongoing research on this topic. Getting control of a computer’s BIOS or any other part of crucial firmware allows adversaries to either control or at least watch the code a machine is running. Imagine your firmware having an extra layer of virtualisation technology. Usually this is undesirable, especially if an unknown third party is accessing this layer. We asked a well-known Information Security Specialist to present the state of the research regarding these extra features in hardware. The talk will also introduce means to detect hidden hypervisors in firmware and give examples where these modifications were found in the wild. Once attackers go to extra sneaky on the stealth scale, you don’t always get the luxury of detecting backchannel activity. Aliens don’t always phone home, unfortunately.
Everyone using black boxes and computer chips should attend this talk. We know that avoiding unknown firmware and chip designs is hard (hence the term hardware), but you should pay attention to unauthorised modifications of these components. This is crucial if you use the hardware for your own (or someone else’s) infrastructure.
Keep in mind: The materials of this presentation have not been published before, and the research covers a period of more than a year. Drop by and raise your paranoia level! ☺