-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thursday 12 June 2008 02:46:19 am you wrote:


Having the read only Backup-BIOS wipe the writable BIOS is simply a
last case scenario. It's a last line of defense incase your primary
BIOS becomes foobar. Keep in mind you would also have a software
antivirus and firewall running on your operating system. So if the
malware happens to get through that it would then have to deal with
the hardware rootkit protection in the mother board. When ever you
boot, the BIOS would use a checksum to check it self for
modifications. I could be wrong but I believe there are similar
security protocols in SELinux and similar technologies to detect if
the Linux kernel has been screwed with.



I suppose I could make it little more simple and just have 2 chips.
One would be a backup and one for primary use. I have a little flash
drive in my pocket right now, it's 8 GB. I'm sure we can design a
sufficiently big enough chip to store the necessary software.



Sure, why not. If you want 100% guarantee, then don't ever use the
internet. If we can figure out how to buy stuff offline with strong
enough encryption with a big enough margin of safety, I'm sure we can
figure out something on how to download updates.



I really don't see that happening. I don't remember ever having any
issues with download patches for openSUSE. Now that I mention it,
the people at Novell have their main update domain bounce you to
random mirrors. So when you download updates, you're not allways
getting them from the same system. Just incase one goes down it'll
bounce you to a different mirror. Which means you don't have to
waste time changing URLs for your updates. Also, the RPM packages
are signed with GPG keys from the people who manage the repositories
you're downloading from. It's to help protect you incase the servers
are compromised. ;-)



It would be possible in theory that when you install new hardware
that have writable ROMs (video card maybe I'm not sure there are any
that are writable) that your mother board makes a checksum of that
ROM's firmware. So on a next reboot your mother board does a quick
check to see if there where any changes and alert you if there is.
Now if we could make this board really clever we could give it enough
room to make backups as well as checksums of all the firmware off all
your hardware. Then if something is changed it could either ask you
if you want to restore from backup or incase of stupid users have it
set to do it automatically.



There is no simple fix for stupidity but to go for a car metaphore
for a moment. You have locks and keys for your house and car. Sure,
if some people wanted to bad enough they can just break the window
hot wire your car and drive off or pick the lock on your house and
steal your TV. Then you can install a car alarm and a GPS for the
cops and install a security system in your house. It's a cat and
mouse game. Persistant people will find ways around almost any
locked door. But that's no excuse not to lock your door. While
security may not keep every one out, it'll keep more people out then
if you use nothing at all. ;-)



Instead of a jumper I suppose you can design it to be automatic in
the instance the writable BIOS failed a cheksum. The system would
then reboot it self, restore from backups after wiping the infected
BIOS, download updates for rkhunter and clamav. Then the BIOS would
force clamav to scan the system for infection. Most of this can be
done automatically in a clever way in the same way scandisk runs on
windows if you shut it down wrong. Something similar hapens on Linux.

Now I'm not suggesting a really long boot process every time you turn
on the system. On every boot it would only check the BIOS for
modification and maybe the MBR then continue on it's marry way. All
this it meant to do is help protect against rootkits. This could
also help serve as a protection measure against failed BIOS flashes
to update the BIOS. Which has happened to me before. I ordered a
board for my dad and noticed the BIOS was out of date. I followed
the directions to the letter. Downloaded the updates from the
companies site attempted to flash the system. Everything appeared to
work. But when I rebooted the damn thing all I got was a black
screen.

Now if mother boards had been built with a second read only chip as a
backup to restore from I wouldn't have waisted days sending it back
in the mail telling them it was DOA so I can get another one.


combined with reflashing the BIOS every once in a while, can give
exactly the same result.

This might work for people like you and me but this wont work for the
average person.



I find most people do that with everything that seems to be a
boundary between them and what they really feal like doing on the
computer. If it comes to taking maybe 10 seconds to read a security
alert from their antivirus or firewall or spending that 10 seconds on
myspace they'll choose myspace every time and just click what every
to make the window go away. Which is what my brother did with his
firewall and ended up blocking all traffic. He couldn't figure out
what magical beast broke his internet so he managed to uninstall the
firwall all together which took the antivirus with it. Which is how
he ended up infected with more viruses then a Nigerian hooker. I had
to tell him to stop using limewire and if he insisted on downloading
stuff to learn how to use bittorrent.



As I said above, a more clever system will do it all automatically.
If you shut down most operating systems improperly they're smart
enough to run software to scan the file system for damage on the next
reboot. Perhaps my idea is overly complicated, but the point I was
trying to make still stands. This is the 21st century, mother boards
need to be taking a more active role in protecting them selves from
the crap that's out there. Because stupid users isn't going to do it
for them.

Hardware manufactories need to get off their lazy a$$es and start innovating. Oh well, there's always the technological singularity to look forward to. Then machines can fix them selves and not rely on stupid users. Some times I wish the Matrix was reality. A lot of people out there deserve to be turned into batteries. ;-) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) iD8DBQFIUP3qvsn/sQCIOqQRAsrDAJ0c3Ls2SWFLW+OgHqxjJuGzcmv0cgCcD7uZ GFi/3lCpnVf7ig4Z1RVWd+I= =UBPq -----END PGP SIGNATURE----- _______________________________________________ http://www.opencores.org/mailman/listinfo/cores