BIOS/UEFI Attacks

Summary

BIOS/UEFI attacks target the firmware layer of computer systems, compromising the Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI) to gain persistent, low-level control over a device. These attacks can bypass traditional security measures, enabling attackers to manipulate system boot processes, install rootkits, and maintain long-term access even after operating system reinstallation.

Key Characteristics

• Focus on firmware-level compromise below the operating system.
• Enables persistent and stealthy control over affected devices.
• Often used to install bootkits or firmware rootkits.
• Can survive OS reinstallation and hard drive replacement.
• Requires privileged access or exploitation of firmware vulnerabilities.
• Targets BIOS or UEFI firmware interfaces on motherboards.

Defensive Controls

• Enable Secure Boot to ensure only trusted firmware and bootloaders run.
• Regularly update BIOS/UEFI firmware with vendor-supplied patches.
• Use hardware-based root of trust and trusted platform modules (TPM).
• Implement firmware integrity verification and monitoring tools.
• Restrict physical and administrative access to prevent unauthorized firmware modifications.
• Employ endpoint detection and response (EDR) solutions capable of detecting firmware anomalies.

Related Security Solutions

Security solutions related to BIOS/UEFI attacks include Secure Boot implementations, firmware integrity verification tools, trusted platform modules (TPM), endpoint detection and response (EDR) systems, hardware security modules (HSM), and advanced threat protection platforms that monitor low-level system behavior.