System Firmware (T1542.001) is a Stealth and Persistence technique. MITRE lists network devices and Windows. BIOS, UEFI and EFI are the software layer between the operating system and the hardware, and an adversary who changes them can run code before anything else.
How attackers use it
MITRE explains that capabilities exist to overwrite system firmware, which may give sophisticated adversaries a way to install malicious firmware updates for persistence. Firmware underlies the whole machine, so changes there can carry out or assist other malicious activity, and they are hard to detect.
How to detect it
MITRE's analytics:
- On endpoints: unexpected write operations to BIOS or UEFI firmware regions or EFI boot partitions that do not correlate with legitimate vendor updates. Vendor flash tools run from non administrative or non IT accounts. Raw disk writes to firmware partitions followed by odd reboots.
- On network devices: unauthorized firmware uploads to routers, switches or firewalls by TFTP, FTP or SCP, boot variable or startup image changes that point to non standard images, and abnormal reboots or rollbacks after configuration changes.
How to reduce the risk
MITRE lists three mitigations:
- Boot Integrity: check the integrity of the existing BIOS or EFI to see if it can be modified, use TPM technology, and move the root of trust into hardware to protect the SPI flash memory. Technologies such as Intel Boot Guard can help.
- Update Software: patch the BIOS and EFI as necessary.
- Privileged Account Management: prevent adversary access to the privileged accounts needed for this technique.
Check your own environment
- Do you know the current firmware version for each hardware model, and is it supported?
- Is secure boot on and a TPM present on endpoints and servers?
- Do you alert on firmware flashing tools run outside IT processes?
On Windows, a read only check is Confirm-SecureBootUEFI in an elevated PowerShell session.
Quick check
Why does reinstalling the OS not remove firmware malware?
Firmware lives below the operating system, so a reinstall does not touch it. MITRE describes this layer as difficult to detect and persistent.
