How would you verify on demand that the BIOS isn't compromised?

timtadh · on April 18, 2014

I don't know about "on demand" but PCEngines will give the source for the BIOS and has an older version posted to the site. http://pcengines.ch/tinybios.htm

devconsole · on April 18, 2014

What I mean is, how would we verify the BIOS firmware matches what that source code should produce? If it's possible for us to make our own builds (i.e. there's no cryptographic signing for the BIOS binaries) then an adversary can insert a backdoor into the source code, make their own build, and then remotely flash your hardware with it. Or does flashing the hardware require some kind of manual operation, like holding down a button for 30 seconds?

lurkinggrue · on April 18, 2014

Could be the processors as well, better to forge the chips by hand to be sure.