How do you check a BIOS for malware?

[Koenig168]

In a YOLO moment, I downloaded and installed a BIOS for my HP i7-3770 rig uploaded by some Russian. I couldn't find an official BIOS from HP and was trying to improve on the stock HP BIOS.

On hindsight, that was probably a daft thing to do. While the rig is working well and has not imploded yet, I am a tad concerned about keyloggers and other nasty stuff.

So ... anyone got any ideas on how to check the BIOS for malware?

P.S. I considered re-flashing back the original BIOS but the HP website has zero BIOS - no original BIOS, no updated BIOS, nothing.

P.P.S. I've already scanned twice with anti-virus, including thorough scanning for rootkits and no threat was detected.

 

[hlots123]

i not tried, but u can try upload the bios file to virustotal. but unsure if we can understand properly even if it reports anything...

What's probably most interesting is the extraction of the UEFI Portable Executables that make up the image, since it is precisely executable code that could potentially be a source of badness. These executables are extracted and submitted individually to VirusTotal, such that the user can eventually see a report for each one of them and perhaps get a notion of whether there is something fishy in their BIOS image. Additionally, the tool will highlight which of these extracted PEs are Windows targeted, i.e. they will run on the Windows OS itself rather than on the UEFI pseudo-OS. Usually you would not see Windows executables in this layer, though there are some exceptions