DetailedSeverity: HighCAPEC-532

CAPEC-532: Altered Installed BIOS

Description

An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.

Likelihood of attack: Low
Typical severity: High
Abstraction: DetailedA low-level, detailed pattern, often for a particular technology.

Mechanism of attack: Manipulate System Resources

Prerequisites

Advanced knowledge about the installed target system design.
Advanced knowledge about the download and update installation processes.
Access to the download and update system(s) used to deliver BIOS images.

Skills required

HighAble to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later compromise and/or disruption.

Mitigations

Deploy strong code integrity policies to allow only authorized apps to run.
Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.
Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins.
Require SSL for update channels and implement certificate transparency based verification.
Sign update packages and BIOS patches.
Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.

Related weaknesses (CWE)

CAPEC 3.9 links no CWE weakness to this pattern.

ATT&CK techniques (CAPEC taxonomy mapping)

Across MITRE's defensive frameworks

Linked through the 2 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

6 more in the full list

Related attack patterns

Parent

CAPEC-444Development AlterationStandard

Mitigations

Deploy strong code integrity policies to allow only authorized apps to run.

Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.

Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins.

Require SSL for update channels and implement certificate transparency based verification.

Sign update packages and BIOS patches.

Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.