Dark Mode
Capec-532 Detail
Altered Installed BIOS
Detailed Supply Chain Software Likelihood: Low Typical Severity: High
Parents: 444
Threats: T62 T68 T274 T393
An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-532 | capec | https://capec.mitre.org/data/definitions/532.html | |
| T1495 | ATTACK | https://attack.mitre.org/wiki/Technique/T1495 | Firmware Corruption |
| T1542.001 | ATTACK | https://attack.mitre.org/wiki/Technique/T1542/001 | Pre-OS Boot:System Firmware |
| REF-439 | reference_from_CAPEC | http://www.mitre.org/sites/default/files/publications/supply-chain-attack-framework-14-0228.pdf | John F. Miller, Supply Chain Attack Framework and Attack Patterns, 2013, The MITRE Corporation |
| REF-716 | reference_from_CAPEC | https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/supply-chain-malware | Daniel Simpson, Dani Halfin, Andrews Mariano Gorzelany, Beth Woodbury, Supply chain attacks, 2021--10---28, Microsoft |
Not present
- Advanced knowledge about the installed target system design.
- Advanced knowledge about the download and update installation processes.
- Access to the download and update system(s) used to deliver BIOS images.
Not present
| High |
|---|
| Able to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later compromise and/or disruption. |
Not present
- An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the normal functionality will also at a specific time of day disable the remote access subsystem's security checks. The malicious BIOS is put in place on the manufacturer's website, the victim location is sent an official-looking email informing the victim of the availability of a new BIOS with bug fixes and enhanced performance capabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allows for additional compromise by the attacker.