What would a BIOS exploit mean for QUBES users..?

[neilh...@gmail.com]

What would a BIOS exploit mean for QUBES users..?

1. Can the BIOS directly access the network? For something like sending keystrokes directly to the network card, bypassing QUBES OS..?

2. Or does it just inject something into the OS upon boot, and then it's an infected QUBES OS itself which transmits keystrokes?

3. Or can keystrokes and data be stored in the BIOS for retrieval for retrieval if someone has physical access to the computer?

4. Or something else altogether?

I want to know as much about what a BIOS exploit could do for QUBES users.

[Fabian Wloch]

Well, as far as I know, it would be 1+2+3+4.
If you have BIOS access, you have pretty much access to *everything*.

Thats the reason I decided myself against a DualBoot System with my new workstation. Still thinking about buying a new seperate computer for gaming, or using my really-really old one for this, because there is no chance in hell I boot something else beside Qubes on this machine.

-Fabian

[Chris Laprise]

Qubes can also be thought of as a way to prevent BIOS exploits from
succeeding, especially from the network or USB. Qubes' anti-evil-maid
feature can also help protect against physical attacks on the BIOS.

Chris

[neilh...@gmail.com]

Does the BIOS have access to the network directly though, or does it have to push an exploit into Qubes itself, which then sends it through the network?

That was one of my main questions.

[Chris Laprise]

On 08/30/2016 06:27 PM, neilh...@gmail.com wrote:
> Does the BIOS have access to the network directly though, or does it have to push an exploit into Qubes itself, which then sends it through the network?
>
> That was one of my main questions.

Since the malware could take the form of a 'blue pill', I would assume
the former is true...
https://theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html

Chris