BIOS malware is a thing

[Retro]

The BIOS / UEFI is the one place that malware can't infect, right? Wrong and here's why.

Oh and if it nails your motherboard, you have a real problem because of the following:

• Being at the root level, it's usually undetectable by the operating system or security software
• It requires a hardware fix by either replacing / reprogramming the BIOS chip, or replacing the motherboard and hoping you don't get hit again

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Astro What]

There are several mini pc's (cheap ones) that are being sold that are infected with malware, both at the BIOS level and the Windows install level.
Generally when you buy one of the off-brand computers, the first thing you do is activate the Windows license by going through the install routine.
After that, you take your USB thumb drive and install a virgin copy of Windows direct from Microsoft. If the license is good, it will activate again. That way, you bypass the crap that gets put on from the vendor.
For the BIOS... it's pretty much a "rotsa ruck" situation.

 

[Retro]

It sounds like some cheap no name garbage made in China and sold through dodgy outlets would qualify for infection from new. It may well have a pirate copy of Windows on it too.

 

[live627]

Surely a motherboard sold by some rando on Reddit won't be infected, right? Right?

 

[Astro What]

It sounds like some cheap no name garbage made in China and sold through dodgy outlets would qualify for infection from new. It may well have a pirate copy of Windows on it too.

Well known brand (yes, from China as is most of this stuff). I don't think Amazon meets the requirement of a dodgy outlet.
And the licenses are valid OEM license packages. There is some question as to where in the pipeline the stuff got installed. It is not a frequent occurrence. I'm only aware of 2-3 different lines of mini PCs. Others from that vendor do not have the issue.