Hardware infection involves malicious manipulation of the physical components of a computer system, such as the motherboard, BIOS, storage devices and peripherals. This type of attack is highly sophisticated and it operates at a much deeper level than conventional malware. Its consequences can be serious for security and system integrity, as it can allow the attacker to maintain persistent access and perform malicious actions that are difficult to detect.

Examples of hardware attacks include:

Malicious firmware: Firmware is designed to provide instructions and control over the hardware of the device in which it is installed. It is often stored on non-volatile memory chips within the device, such as ROM, EEPROM or flash memory. This software is critical for the proper operation and performance of the device, as it controls its basic operation and provides the necessary interfaces for communication with other devices and systems. Figure 3 shows the malicious firmware distribution process.

Attackers can manipulate the firmware of hardware devices, such as the BIOS or the firmware of a network card, to introduce malicious code. This can allow them to maintain persistent access to the system, even after operating system reinstallations.

By directly attacking hardware components, a virus can achieve an extremely high level of persistence on a system. Even formatting or reinstalling the operating system will not eliminate the infection, as the virus resides at a deeper level, in the device's firmware, and it executes before the operating system is loaded.

However, Secure Boot and UEFI provide an additional layer of protection by verifying the digital signature of firmware components during the boot process. This helps to prevent the execution of unauthorized or modified firmware, making more difficult to viruses to infect these components. Although these security measures have reduced the effectiveness of attacks targeting the BIOS, UEFI (Unified Extensible Firmware Interface) and the boot sector, rootkits (malicious software) remain as the main form of infection that exploits these vulnerabilities.

An attacker can manipulate the firmware of hardware devices, such as the BIOS or the firmware of a network card, to introduce malicious code. This can allow the attacker to maintain persistent access to the system, even after operating system reinstallations.

Compromised USB devices: When connecting infected USB devices, there is the risk that they contain viruses that automatically install on the system. These viruses can perform malicious activities, such as stealing confidential information or compromising system security. Figure 4 shows the possible harms that a compromised USB device can cause.

Attacks on microcontrollers and microprocessors: These components can be vulnerable to physical attacks or reverse engineering, which aim to modify their behaviour to perform malicious actions.

Hardware tampering during manufacturing: Throughout the hardware supply chain, from component manufacturing, assembly, quality testing, to hardware packaging and distribution, there is a risk that devices can be compromised or maliciously tampered with during some stage of this process. This potential risk includes the possibility of modifying the hardware to introduce potential vulnerabilities.

To mitigate hardware attacks, it is essential to implement the following key preventive measures: