cve.bz

CAPEC-532

Altered Installed BIOS

High severityLow likelihoodDetailed pattern

An attacker with access to download and update system software sends a maliciously altered BIOS to the victim or victim supplier/integrator, which when installed allows for future exploitation.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-532: Altered Installed BIOS: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/532.html and https://cve.bz/cve/capec/532?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

Prerequisites

  • Advanced knowledge about the installed target system design.

  • Advanced knowledge about the download and update installation processes.

  • Access to the download and update system(s) used to deliver BIOS images.

Skills required

  • High skill

    Able to develop a malicious BIOS image with the original functionality as a normal BIOS image, but with added functionality that allows for later compromise and/or disruption.

Mitigations

  • Deploy strong code integrity policies to allow only authorized apps to run.

  • Use endpoint detection and response solutions that can automaticalkly detect and remediate suspicious activities.

  • Maintain a highly secure build and update infrastructure by immediately applying security patches for OS and software, implementing mandatory integrity controls to ensure only trusted tools run, and requiring multi-factor authentication for admins.

  • Require SSL for update channels and implement certificate transparency based verification.

  • Sign update packages and BIOS patches.

  • Use hardware security modules/trusted platform modules to verify authenticity using hardware-based cryptography.

Part of

Examples

An attacker compromises the download and update portion of a manufacturer's web presence, and develops a mali…

An attacker compromises the download and update portion of a manufacturer's web presence, and develops a malicious BIOS that in addition to the normal functionality will also at a specific time of day disable the remote access subsystem's security checks. The malicious BIOS is put in place on the manufacturer's website, the victim location is sent an official-looking email informing the victim of the availability of a new BIOS with bug fixes and enhanced performance capabilities to entice the victim to install the new BIOS quickly. The malicious BIOS is downloaded and installed on the victim's system, which allows for additional compromise by the attacker.

MITRE's words, unchanged: CAPEC-532 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.