BIOS/UEFI Lesson 003: BIOS/UEFI Security

What area of the computer can be attacked during the boot-up phase?

The pre-operating system environment.

Are the BIOS and UEFI the same?

No, they're two different types of firmware used to assist during the loading and boot-up of an OS.

How does BIOS store boot information and identify partitions?

Using the MBR.

How does UEFI store boot information and identify partitions?

Using the GPT.

What is an optional feature that can be included in UEFI firmware?

Network capability and web browsing access.

Supervisor/Administrator/Setup Password

Used to protect access to the BIOS or UEFI configuration program and prevents unauthorized access to configuration tools.

User/System Password

Used to lock access to the entire computer, and is prompted on startup before booting BIOS or UEFI.

Storage/Hard Drive Password

Password that locks access to a hard drive connected to the system and requires the end user's password.

What function does the storage/hard drive password block?

Access for an OS to be booted from the locked device.

How can UEFI be protected with a password?

By using and implementing the supervisor/administrator/setup password.

Why is the user/system password usually not used?

Because this password is used to gain access to the computer before boot-up.

Why is it now common practice to use a storage/hard drive password?

Because a lot of OSes now have that capability built in.

Secure Boot

A security function that can be enabled only on UEFI interface and settings.

What does secure boot ensure?

That the computer has not been hijacked by malicious code injected into the operating system.

What does the firmware do when booting in "secure boot" mode?

Firmware verifies that all the UEFI executable files and OS loader have intact integrity, with no malware compromization.

What does the OS boot components do when booting in "secure boot" mode?

Verify the digital signature of each component prior to loading them.

What happens if the OS boot components throws a failed signature check while in "secure boot" mode?

The boot-critical drivers won't load and will trigger an alert to the end user.

What is the final check that boot-critical drivers fo through when booting in "secure boot" mode?

Are checked against their known good hashes and if they pass, they will be loaded up.

What does "secure boot" ensure?

That the operating system is trusted and not compromised by rootkits.

What must be true for "secure boot" to work?

It must be enabled in UEFI and supported by the operating system.

What is another thing that can be done on modern systems to ensure that malware is not physically introduced to a system?

Disabling USB ports on a device, disabling the ability for a USB to act as a mass storage device.

What is protected as a result of restricting USB port functionality?

Prevents malware from being physically introduced to the system against data theft and data destruction.

Where can the functionality of blocking USB ports or restricting mass storage devices be found on a system?

In the UEFI.