// Home / News / Security

BIOS needs stronger security, say researchers

By Stewart Mitchell

Posted on 12 May 2011 at 13:21

The computer industry must build better security into the boot process to create safer systems, according to the US's National Institute of Standards and Technology (NIST).

The basic input/output system (BIOS) in a computer is especially at risk because of the central role it plays within PC, according to the NIST engineers working on the project.

“Unauthorised modification of BIOS firmware by malicious software constitutes a significant threat because of the BIOS’s unique and privileged position within the PC architecture,” NIST said.

“A malicious BIOS modification could be part of a sophisticated, targeted attack on an organisation, either a permanent denial of service (if the BIOS is corrupted) or a persistent malware presence (if the BIOS is implanted with malware).”

As a result, the institute has called for manufacturers and BIOS creators to use a series of measures that it claims would enhance security from the bottom up.

Primarily, NIST demanded building ID verification features into the BIOS to help protect it from attackers.

Hackers could currently abuse the access routes built into systems to allow manufacturers to update system firmware, fix bugs, patch vulnerabilities and support new hardware.

“The guidance calls for using cryptographic digital signatures to authenticate the BIOS updates before installation,” NIST said.

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

User comments

Is this an old story?

I thought the BIOS went out with MS Vista to be replaced by EFI or some other thing?

By SwissMac on 12 May 2011

Motherboard manufacturers need to ditch BIOS and implement EFI sooner rather than later. They are very slowly getting there. I think ASUS has an EFI board.

By james016 on 12 May 2011

@SwissMac

Vista merely introduced EFI support, many vendors still use BIOS (presumably because they see no reason to move to EFI).

Aren't there also other alternatives to BIOS like coreboot?

By tech3475 on 12 May 2011

@SwissMac - Good of you to refrain from gloating over how the Mac already uses EFI! There seems to be a big push to get EFI on the Sandy Bridge generation motherboards. As James says, the OS enables it, but it is up to hardware manufacturers to actually implement it.

Longer term there really is no need for a "boot" process at all these days. Just put the entire OS in flash memory. Better still, put a simple Hypervisor platform in flash and run the OS in a virtual machine.

By JohnAHind on 12 May 2011

I think EFI BIOSes are a requirement for a sandy bridge motherboard..

By Hereisphilly on 13 May 2011

I think EFI BIOSes are a requirement for a sandy bridge motherboard..

By Hereisphilly on 13 May 2011

BIOS Security AGAIN

The best way to protect your computer is to keep humans away from it altogether.

Right Protect Hardware Switches prevent BIOS malware.

In house security starts IN HOUSE so no bugs get onto the system.

By lenmontieth on 13 May 2011

A comment from a different sight [Sorry it is plagiarised]
Quote
If the cyber criminals managed to get an inside man/woman, at a motherboard factory
Unquote.

Well what more could I say?

By lenmontieth on 13 May 2011

Leave a comment

You need to Login or Register to comment.