Some Motherboards Plagued by BIOS Firmware Implementation Flaws

[LASER_oneXM]

Alex Matrosov, a security researcher for Cylance, has discovered several flaws in how some motherboard vendors implemented Intel's UEFI BIOS firmware into their products.

These flaws allow an attacker to bypass BIOS firmware protections, such as Intel Boot Guard and Intel BIOS Guard, to disable and alter UEFI BIOS firmware, such as placing a rootkit.

Matrosov presented his findings at the Black Hat USA 2017 security conference held in Las Vegas in August.

Flaws found in at least four motherboard series
In total, Matrosov found six vulnerabilities in four motherboards he tested, according to an interview he gave before the conference:

ASUS Vivo Mini - CVE-2017-11315
Lenovo ThinkCentre systems - CVE-2017-3753
MSI Cubi2 - CVE-2017-11312 and CVE-2017-11316
Gigabyte BRIX series - CVE-2017-11313 and CVE-2017-11314

The motherboards Matrosov tested were based on AMI Aptio UEFI BIOS, a popular UEFI BIOS firmware package, also used by other motherboard OEMs such as MSI, Asus, Acer, Dell, HP, and ASRock.

OEMs don't use all of Intel's hardware protections
"Some vendors don’t enable the protections offered by modern hardware, such as the simple protection bits for SMM and SPI flash memory (BLE, BWE, PRx), which Intel introduced years ago," Matrosov explained the problem. "This makes them easy targets for attackers since they have no active memory protections at the hardware level."

Matrosov says that an attacker can exploit these implementation errors to elevate privileges, bypass BIOS protections, and deliver rootkits on a modern operating system, such as Windows 10, for which Microsoft has worked tirelessly to safeguard against rootkits.


Yesterday, Embedi security researcher Alexander Ermolov published new research based on Matrosov's initial work that bypasses the Intel Boot Guard protection system on a Gigabyte GA-H170-D3H motherboard, showing the problem is most likely more widespread that Matrosov's initial tests.