Pity the poor BIOS hacker

Darren Pauli for The Register:

Millions of flawed BIOSes can be infected using simple two-minute attacks that don’t require technical skills and require only access to a PC to execute.

I don’t often feel sympathy with people who attack other people’s data and systems, but I feel deeply sorry for those poor unfortunates condemned like a modern Flying Dutchman to wander the earth, breaking into millions of homes and offices so that they can get physical access to PCs and infect the BIOS.

By my reckoning, that’s around 3.8 man years per million PCs, not including travel time between sites, sleep, eating, and visiting the bathroom.

The article refers to a presentation at CanSecWest by Xeno Kopvah and Corey Kallenberg, but a presentation covering somewhat similar ground for Schmoocon seems to include the crucially different assertion that ‘Attacker does not need physical presence to attack BIOS . ‘ Well, that’s sometimes true. But clearly not explicitly stated in the CanSecWest abstract. I shall await further clarification with bated breath.

David Harley


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.