Bad BIOS Malware

I will outline the malware that we face today. The malware today is more sophicicated then it was 15-20 years ago. The malware we see today is written by professional cyber criminals and government agency's. The new breed of malware is cross platform and can infect multiple devices, morph and change its code at will, target low level firmware, and can infect devices that are not connected to the Internet (Air Gap Malware. ) Ruiu claimed that he had malware that could infect all his peripheral devices. Security researchers Karsten Nohl and Jakob discovered a flaw that affects virtually all usb devices. The security researchers that discovered the flaw called it Badusb. Infected USB devices can: * enter keystrokes * alter or infect files * affect Internet activity * infect other systems, as well, and then spread to additional Usb devices (reprogram firmware) * spoofs a network card and change the computer"s DNS setting to redirect traffic, allow hackers direct access, so that they may attack nearby devices * emulates a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware Source: . http://thehackernews.com... The new rootkits and bootkits are undetectable by any antivirus product on the market, survive even if the hard drive is replaced, and can also survive even if you reflash the BIOS. The infected BIOS can survive reflashing in the following ways: * The reflash operation is under control of. .. the BIOS, so the infected BIOS only pretends to do the reflash (or reinfects the new BIOS immediately afterwards). R32; * Another flashable firmware in the machine is also infected, and when either it or the BIOS is reflashed, the still infected firmware reinfects the other one. Any device with DMA can hijack the live machine at any point, and most devices with a firmware have an onboard CPU which would be up to the task (GPU, hard disks. .. ). R32; * The disk firmware is infected, and inserts malicious code in the boot code which reinfects the BIOS. R32; Ruiu claimed that the malware also infected his Mac even though it was not connected to the Internet. Hackers have several ways of hacking into computers even when they are disconnected from the Internet. Types of Air-gap malware: Stuxnet: (USB drive that attacks lower firmware) No autorun file present USBee: Malware can transfer Data via USB emissions from Air-Gapped computers 3G Intel Chip: Intel Core Vpro processors contain a 3G chip that allows remote disabling and backdoor access to any computer even when it is turned off. Intel embedded the 3G radio chip in order to enable its Anti Theft 3.0 technology. The Technology is found on every Core i3/i5/i7 CPU after Sandy Bidge has this technology. Infected Phone can infect computer and vice versa: Smart phones have become more powerful and have become another tool that hackers use. If you plug your phone into a PC or Mac via USB, the hacker can use your phone to attack that device. A hacker can also use that same phone to attack nearby devices. The hacker can also use that phone to attack other wifi devices, wireless router, Bluetooth devices, and just about any wireless technology that uses (2.4GHz-5GHz). That same phone can also infect any USB charger that you use to charge your phone. Turla APT Malware: uses satlilites to avoid detection. Air Hopper: Malware can use radio signals to steal data from non network Computers Sources: . https://www.codeproject.com... . http://www.welivesecurity.com... When Ruiu publicly announced that Malware can spread via speakers and microphones, most security researchers thought he was crazy; Ruiu then submitted a proof of concept of concept. Three years later researchers were able to create malware using inaudible sounds. . http://gizmodo.com... Bad BIOS can also mutate and has self healing capabilities. Metamorphic malware and polymorphic malware changes its shape like a real virus. . https://ammarhasayen.com... The new breed of malware can self destruct to avoid analysis, wiping all data on the hard drive, Infect Antivirus and malware removal tools using SQL injection, and infect DLL files and services. Malware can also uninstall itself and erase all traces of the malware. Ruiu is well respected in his field, he has nothing to gain by making it up, only his reputation. Ruiu probably did try to provide proof that what he encountered was real; the people behind this Malware want to keep it top secret. Ruiu made an educated guess and came up with his own hypothesis as to how this mysterious Malware works. Ruiu may of had some things wrong; He was researching a new type of malware that he never encountered before. Bad BIOS malware doesn't have a set of rules. Ruiu could have been infected with a GPU Paravirtulation root, or an advance TDL-4 bot (boottrash) I will post a link below of a video that I made and posted on youtube. I was infected with a GPU rootkit, the malware didn't even have to phone home. . https://m.youtube.com...