Some Motherboards Plagued by BIOS Firmware Implementation Flaws

Alex Matrosov, a security researcher for Cylance, has discovered several flaws in how some motherboard vendors implemented Intel's UEFI BIOS firmware into their products.

These flaws allow an attacker to bypass BIOS firmware protections, such as Intel Boot Guard and Intel BIOS Guard, to disable and alter UEFI BIOS firmware, such as placing a rootkit.

Matrosov presented his findings at the Black Hat USA 2017 security conference held in Las Vegas in August.

Flaws found in at least four motherboard series

In total, Matrosov found six vulnerabilities in four motherboards he tested, according to an interview he gave before the conference:

The motherboards Matrosov tested were based on AMI Aptio UEFI BIOS, a popular UEFI BIOS firmware package, also used by other motherboard OEMs such as MSI, Asus, Acer, Dell, HP, and ASRock.

OEMs don't use all of Intel's hardware protections

"Some vendors don’t enable the protections offered by modern hardware, such as the simple protection bits for SMM and SPI flash memory (BLE, BWE, PRx), which Intel introduced years ago," Matrosov explained the problem. "This makes them easy targets for attackers since they have no active memory protections at the hardware level."

Matrosov says that an attacker can exploit these implementation errors to elevate privileges, bypass BIOS protections, and deliver rootkits on a modern operating system, such as Windows 10, for which Microsoft has worked tirelessly to safeguard against rootkits.

Yesterday, Embedi security researcher Alexander Ermolov published new research based on Matrosov's initial work that bypasses the Intel Boot Guard protection system on a Gigabyte GA-H170-D3H motherboard, showing the problem is most likely more widespread that Matrosov's initial tests.

The good thing, according to Matrosov, is that motherboard vendors, including AMI, have issued UEFI BIOS firmware updates to address the flaws he discovered, and which enable the Intel hardware-level protections that come with modern CPUs.

Break down IAM silos like Bitpanda, KnowBe4, and PathAI

Broken IAM isn't just an IT problem - the impact ripples across your whole business.

This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.

Get the guide