There is a huge fear about BIOS rootkits.
So until recently, the idea was that the device's BIOS had to implement, in
software, ways to make sure that only official BIOSes could be reflashed via
software.
In practice, some BIOS don't have any "protection" against reflashing, which
is good for us.
Some other have various degrees of protection. I think they can all be
broken, but some are BIOS specific, so it requires some work.
Because the software protection didn't hold, some vendors now use code
signing at the hardware level, so the hardware (The CPU) won't load any code
not signed by the device manufacturer.
Here you can see a conflict between freedom, and preventing (additional)
rootkits in proprietary software.
A very similar conflict is present for bootloaders of Android phones, where
permitting to load your own bootloader would permit to rootkit the phone, and
easily access all the data inside it because you load your code before the
OS.
I think we should try to find good solutions so the chip and device
manufacturer, freedom, and security of users using the default software would
go well together.
Denis.
