Home > CAPEC List > CAPEC-532: Altered Installed BIOS (Version 2.9)  

CAPEC-532: Altered Installed BIOS

 
Altered Installed BIOS
Definition in a New Window Definition in a New Window
Attack Pattern ID: 532
Abstraction: Detailed
Status: Draft
Completeness: Stub
Presentation Filter:
+ Summary

An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.

+ Attack Prerequisites
  • Advanced knowledge about the installed target system design.

  • Advanced knowledge about the download and update installation processes.

  • Access to the download and update system(s) used to deliver BIOS images.

+ Typical Severity

High

+ Typical Likelihood of Exploit

Likelihood: Low

The nature of these type of attacks involve a coordinated effort between well-funded multiple attackers, and sometimes require physical access to successfully complete an attack. As a result these types of attacks are not launched on a large scale against any potential victim, but are typically highly targeted against victims who are often targeted and may have rather sophisicated cyber defenses already in place.

+ Examples-Instances

Description

An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the normal functionality will also at a specific time of day disable the remote access subsystem's security checks. The malicious BIOS is put in place on the manufacturer's website, the victim location is sent an official-looking email informing the victim of the availability of a new BIOS with bug fixes and enhanced performance capabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allows for additional compromise by the attacker.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: High

Able to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later compromise and/or disruption.

+ References
[R.532.1] [REF-50] John F. Miller. "Supply Chain Attack Framework and Attack Patterns". The MITRE Corporation. 2013. <http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf>.
[R.532.2] ATT&CK Project. "Basic Input/Output System (1019)". MITRE. <https://attack.mitre.org/wiki/Basic_Input/Output_System>.
+ Content History
Submissions
SubmitterOrganizationDateSource
CAPEC Content TeamThe MITRE Corporation2014-06-23Internal_CAPEC_Team
Modifications
ModifierOrganizationDateCommentsSource
CAPEC Content TeamThe MITRE Corporation2015-11-09Updated References, Related_Attack_PatternsInternal
Previous Entry Names
DatePrevious Entry Name
2015-11-09Altered BIOS Installed After Installation

More information is available — Please select a different filter.
Page Last Updated or Reviewed: December 07, 2015