New rootkit attack targets Bios

Researchers have warned that anti-virus software will not help against a new form of attack that involves installing a rootkit directly into a computer's Bios system.

Almost all types of common Bios systems currently in use are vulnerable, Alfredo Ortega and Anibal Sacco of Core Security Technologies said.

They discovered a 100-line Python script capable of being flashed onto the Bios to install a rootkit. Normal anti-virus software would not be able to detect it because Bios software activates before any other program on a computer when it starts up.

Mr Ortega said: "We tested the system on the most common types of Bios.

"There is the possibility that newer types of Extensible Firmware Interface Bios may be resistant to the attack, but more testing is needed."

The attacker must have full administrative control of the PC - possible through a standard virus infection. A rootkit can then be flashed directly onto the Bios.

Researchers warned that even a full hard drive wipe and complete operating system reinstallation would be useless.

Ivan Arce, Core Security's chief technology officer, said: "You would need to reflash the Bios with a system that you know has not been tampered with.

"But if the rootkit is sophisticated enough it may be necessary to physically remove and replace the Bios chip."