Mysterious cross-platform virus badBIOS

by anonymous on 2013-11-16 19:01:36

Three years ago, security consultant and Pwn2Own hacking competition founder Dragos Ruiu noticed something unusual in his lab: a MacBook Air that had just been freshly installed with OS X automatically updated its BIOS firmware. Later, when he attempted to boot the machine from the CD-ROM, it was refused. He also discovered that the machine would delete data and revert configuration changes without any warning.

In the following months, things became increasingly bizarre, as if taken straight out of a sci-fi thriller: a computer running OpenBSD also began deleting data and altering configurations without any prompt. His network was specifically transmitting data via IPv6, and even disabling the IPv6 protocol proved ineffective.

Most incredibly of all, infected machines that were disconnected from power, Ethernet cables, and had their Wi-Fi and Bluetooth cards removed, were still able to transmit network data. The mysterious BIOS firmware virus, badBIOS, could also infect Windows and Linux systems. Further investigation revealed that only after removing the internal speakers and microphone did packet capture tools stop detecting data transmission.

Ruiu pointed out that this malicious program can use speakers and microphones for high-frequency transmissions between computers. badBIOS does not spread viruses through speakers or microphones but communicates between infected machines via the microphone, essentially creating a network between them.