CyberGlossary

Malware

BIOS Rootkit

Also known as: Legacy firmware rootkit

Definition

A rootkit that infects legacy BIOS firmware so it executes before the operating system, achieving deep persistence below the OS.

A BIOS rootkit modifies the legacy Basic Input/Output System (BIOS) — the firmware that ran on x86 systems before UEFI became standard — to gain control during early boot. Because the BIOS executes before any operating-system protections, the rootkit can disable security tooling, hide other malware, and re-infect a freshly installed OS. Successful infection typically requires kernel-level privileges to flash the chip, a misconfigured flash protection, or supply-chain access. Defences include moving to UEFI with Secure Boot, vendor flash-protection mechanisms, signed firmware updates, BIOS write-protect features, integrity attestation, and physical and supply-chain controls for hardware. Modern systems have largely replaced BIOS rootkits with UEFI implants.

Examples

  • Mebromi, an early BIOS rootkit that infected the system firmware to reinstall malware.
  • Computrace-style anti-theft modules abused as a persistence mechanism.

Related terms