Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I was installing questionable operating system onto my EEE pc and it required me to downgrade the BIOS which I really am not an expert at. I used a patch and it appeared to work.

Now, I'm paranoid about the downgrade because, honestly, I have no idea where the code came from or what could be in it.

My question, then, is it possible to "start over" completely fresh with my BIOS? As in wipe out the possibly malicious BIOS and go back to the manufacturer-provided one?

Has anyone done something similar to this? I just want to install Ubuntu Netbook Remix to the EEE pc 1000 but I want to make sure the BIOS are secure.

Any advice would help tremendously, or am I just being uber paranoid? BIOS are definitely not my strength.

share|improve this question
1  
On a total tangent, but I read a story a few days ago about actual honest to god BIOS-level viruses! Forget 'root'kits, that stuff's just scary. Can't format that away! –  Phoshi Sep 16 '09 at 20:48
1  
@Phoshi That is sick... –  alex Sep 16 '09 at 20:49
    
The malware writers are winning. Soon, if you even suspect your system is infected your only option will be to back up your data and buy a new system. That's one reason I think netbooks are the future: they're cheap enough to be subsidized by service contracts and replaced as needed. –  Joel Coehoorn Sep 16 '09 at 21:04
    
Just as a sidenote: There actually is a (sort of) BIOS rootkit available on many systems: It's a computer tracking software system called LoJack (formerly Computrace). When active, the BIOS will automatically install (Windows) software to your harddrive to phone home & track the computer. While not malicious itself, this can be exploited by real malware. Fascinating, but scary. See en.wikipedia.org/wiki/LoJack_for_Laptops and exploiting.wordpress.com/2009/09/11/138 –  sleske Jun 3 '10 at 19:04
    
Interestingly it won't work on operating systems other than Windows. –  ultrasawblade Jul 26 '11 at 14:48

5 Answers 5

If you really have a rootkit in your bios, one of the things that rootkit would likely do is refuse to allow any other updates to be applied. At least, that's what I'd do if I wrote a bios rootkit since, ya know, the computer kinda has to use bios functions to update the bios...

In that scenario, your only options are to force flash it by setting a reset jumper (not likely an option on a netbook) or ripping out the chip and soldering a new one to the motherboard (and good luck with that; you're gonna need it).

The good news is that you probably don't have rootkit, and if you are able to successfully flash the bios with one downloaded from the manufacturer (asus) via the normal means that would pretty much confirm it.

share|improve this answer
    
Thanks, Joel. I'm way out of my element and since this isn't my primary machine I was just experimenting but after I did what I did, I was like, "What the heck did I just do to my machine?" The only reason I have a suspicion is because I did not know where this patch came from--not sure if it was from the official ASUS site. Doh! Thanks again though. –  Leopold_Bloom Sep 16 '09 at 21:08
    
Actually, many flash devices are connected to the SPI or I2C busses and can technically be accessed without BIOS assistance at all. However, if the BIOS flips a "write protect" bit in the flash then BIOS assistance for an update is needed. Not sure if all BIOSes do this. –  ultrasawblade Jul 26 '11 at 14:50

applying an official BIOS from the ASUS support website is perfectly safe.

if you want to use some 'experimental' 3rd party BIOS you do this at your own risk and you'll void the warranty.

as for installing Netbook Remix on the Eee PC 1000, check the Wiki and browse the forum at eeeuser.com, plenty of guides and tips.

share|improve this answer
    
Thank you, Molly. This is really out of my league here but is there a way I can scan my BIOS to see if it has signs of being malicious? And, if I were to re-install the official BIOS would that guarantee that it would overwrite anything questionable that may be on there now? Scary out there yikes! Thanks for all the advice, I value it. :D –  Leopold_Bloom Sep 16 '09 at 21:04
    
what is this scare? your eee doing funny things? just apply the latest official BIOS and be done with it. :) –  Molly7244 Sep 16 '09 at 21:08
    
No, I have no reason to believe I'm infected other than my own paranoia of not knowing exactly what I was doing. I will apply the latest and cross my fingers! Thank you. –  Leopold_Bloom Sep 16 '09 at 21:10

is it possible to "start over" completely fresh with my BIOS? As in wipe out the possibly malicious BIOS and go back to the manufacturer-provided one?

Only by pulling out the BIOS EEPROM chip and replacing it with a known-good one. There are sites that will sell you EEPROMs for various motherboards/BIOS versions, in order to save you when you've burned a bad BIOS and can't boot at all.

If you have an untrusted BIOS you have lost all control of the software layer. You could try to re-flash it with a good BIOS, but since the BIOS has already run it could have rooted the OS you're using, and made it sabotage the BIOS flasher.

The good news is that there are no known attacks that actually do this at the moment, because it's really hard even to author a malicious BIOS that would work across more than a tiny range of motherboards, never mind all the complex payload code. If you just want to brick the machine, on the other hand, that's easy!

share|improve this answer
    
Nice, it's definitely not a brick so I'm probably over-worried. Still, I've learned a lot from asking this question. Love this site, just found it. Thank you! –  Leopold_Bloom Sep 16 '09 at 21:27

I believe there is a way on most sites to reset the BIOS.. usually done with a jumper or soldered wire..

if you want to get physical anyway..

only sure fire bet though is replacing the EEPROM..

wait!

Or you could buy an EEPROM programmer and get a hold of a BIOS dump and upload it that way.. if you really want to have some fun

share|improve this answer
1  
Huh? :D I think I'm going to try to just update the version of the BIOS and then pretend that I never applied these unofficial patches. I assume this is a lot of trouble to create a BIOS rootkit and I'm just overly paranoid. Still, thank you all! –  Leopold_Bloom Oct 15 '09 at 22:54

I've been concerned about this too because a hidden version of a flash player keeps installing very frequently and slowing down the laptops, and I wonder if its hiding in the BIOS because it doesn't matter what OS I install, it still happens. Since there's no video at the time I imagine maybe it has a bot or something in it too. I also can't tell if its correlation or causation that it gets meaner every time I complain about it; It is definitely remote controlled, and circumvents every typical blocking app as well as my own patches... including redirecting every storage device to /dev/null. It consumes all the bandwidth and clockcycles it can when it is active, and also freezes the network connection if I try to do anything. I can't keep that flash player out of the machines at all. I've also noticed it "installs" "coincidentally" when I see a face book or twitter logo on a web page.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.