BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.4 Threats to the System BIOS

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 2 Background part of 2

Title

Threats to the System BIOS

Control

A server is susceptible to the same forms of attack that threaten a client system. Execution of operating system-level malware on servers could precede a BIOS attack. Server BIOS updates that are executed without being authenticated as coming from a trusted source are vulnerable to attacks. Since servers may have multiple BIOS update mechanisms, each mechanism has a risk of vulnerability. The interaction between update mechanisms potentially can also introduce vulnerabilities.

The Service Processor in servers has elevated privileges to perform system management, which may include modifying BIOS. While the Service Processor might be controlled through an isolated communication channel, unauthorized access to this channel exposes great risk to the server. While many security practices focus on the data network, the management network might be less vetted and less protected without special efforts.

If insufficiently protected, BIOS image backups on servers (often maintained for recovery features) are vulnerable to rewrite attacks even while the primary BIOS is protected from modification. Subsequent to successful subversion of a BIOS backup, an adversary could employ other means to cause the server to reboot with the infected backup image.