The Computer Virus That is Puzzling the Internet | BadBIOS

Summary

The video explores the mysterious origins of BadBIOS, alleged to be the world's first computer virus capable of spreading through the air. It analyzes the controversial claims made by its supposed discoverer, including its ability to infect any operating system and transmit wirelessly. The script examines the technical feasibility and limitations of such malware, the skepticism surrounding its existence, and the divided opinions it has generated within the tech community.

Takeaways

• 😱 The story of BadBIOS - a mysterious computer virus allegedly able to infect systems without internet access
• 🤯 Claims to be the first ever computer virus that spreads through sound/air
• 😶‍🌫️ Originated from well-known hacker Dragos Ruiu noticing strange activity on his devices
• 😵 Very technically complex and contradicting story that left many scratching heads
• 🫣 Spread through high frequency sounds played by speakers and picked up via microphones
• 😬 Capable of persisting even after wiping systems clean by hiding in BIOS/UEFI
• 🤔 Highly controversial - some believe it, others call it an elaborate hoax
• 🤨 Lack of evidence and high complexity lead some to believe it doesn't actually exist
• 🕵️‍♂️ Audio transmission has technical flaws making malware very impractical
• 😐 Remains an unsolved mystery whether capabilities are real or an exaggerated hoax

Q & A

What is BadBIOS?

BadBIOS is a mysterious and controversial computer virus first reported in 2010. It allegedly spreads through sound and is able to infect the BIOS of computers, making it very difficult to remove.

How does BadBIOS allegedly spread?

According to reports, BadBIOS spreads through high frequency sounds transmitted from an infected computer's speakers. Nearby computers with microphones can pick up the sounds and become infected.

Why is spreading through sound controversial?

Spreading through sound is controversial because sound waves are susceptible to interference and degradation of data. The feasibility of transmitting malware this way is debated.

Who first reported BadBIOS?

BadBIOS was first reported in 2010 by Dragos Ruiu, a well-respected computer security expert and founder of the Pwn2Own hacking competition.

Why can't anti-virus software detect BadBIOS?

If real, BadBIOS infects the BIOS/UEFI rather than the operating system or programs. Anti-virus software scanning those layers wouldn't detect it.

How could BadBIOS bypass air-gapped computers?

If real, experts theorize BadBIOS initially infected air-gapped machines via USB drives. Once infected, it could potentially spread via sound.

Why is there skepticism about BadBIOS?

There is skepticism because the technical feats claimed seem far-fetched. Also, no samples of BadBIOS code have been analyzed publicly.

Could BadBIOS be an elaborate hoax?

Some believe BadBIOS could be an elaborate hoax or prank, given the seemingly outlandish claims and lack of hard evidence made public.

How difficult would it be to create BadBIOS?

Experts estimate it would require millions of dollars and many years for even advanced hackers to develop malware as sophisticated as claimed.

Is there a way to fully protect against BadBIOS?

No security measures can fully protect against it if real, but keeping BIOS/UEFI firmware updated and avoiding suspicious devices can help.

Outlines

00:00

🤔 How computer virus panic spread in the 90s

Paragraph 1 discusses the fear and misunderstanding around computer viruses in the 1990s, and how some took advantage of this by spreading exaggerated claims. It mentions a Weekly World News story about a fictional virus spreading to humans, highlighting the implausibility.

05:04

👨‍💻 Explaining how computer viruses actually work

Paragraph 2 explains how real computer viruses operate - they are malicious code that spreads by replicating and infecting connected computers over a network. The key is needing a connection.

10:08

🎤 Transmitting data using sound

Paragraph 3 provides background on communicating data via sound, relating it to old telegraph systems. It explains how dial-up modems also used sound to talk to each other. The concept is simple but engineering a virus this way would be complex.

15:13

💬 Challenges with using sound for transmission

Paragraph 4 details issues with using sound for data transmission - it's prone to interference and degradation. The noise ratio makes it unreliable over distances. Multiple conversions also reduce quality. Even minor distortion can lead to failure.

20:16

🤨 Questioning how the virus actually spreads

Paragraph 5 notes inconsistencies in the story. The virus likely didn't use sound but instead spread via infected USB drives. Claims of it working across different BIOS systems seem implausible. Many doubt the story's validity.

Keywords

💡Computer virus

A computer virus is a type of malicious software that infects computers and spreads by replicating itself to other computers on a network. In the video, the narrator discusses the alleged 'BadBIOS' computer virus, which supposedly spreads through the air and infects computers with different operating systems without needing an internet connection. This impossible-sounding virus is the main subject of the video.

💡Air gap

An air gap refers to isolating a computer so that it has no internet or network connections. In the video, the narrator describes how the BadBIOS developer tried using air gaps by disconnecting his infected computers from Wi-Fi and power sources, but the virus still managed to spread between them, making BadBIOS even more mysterious.

💡BIOS

The BIOS refers to the basic input/output system firmware on a computer's motherboard that helps boot and control hardware. The narrator explains how the alleged BadBIOS virus somehow existed in computers' BIOS instead of their operating systems, allowing it to persist even after wiping hard drives.

💡Data transmission

The video discusses the concept of transmitting data through sound, like past telegraph systems. Supposedly, the mysterious BadBIOS virus had the ability to transmit its code through high frequency sounds imperceptible to humans.

💡Hoax

Since many of BadBIOS' reported capabilities seem unbelievable, the narrator suggests it may be an elaborate hoax to create fear/uncertainty like '90s virus hoaxes rather than an actual technological threat.

💡Background noise

The narrator notes how background noise interferes with sound-based data transmission, one reason using speakers/microphones to spread malware is very difficult and why the BadBIOS story raises skepticism.

💡Signal-to-noise ratio

This term refers to the relative strength of a data signal versus background noise interference during transmission. More background noise leads to more distorted data transfers and failed communications.

💡Airborne computer virus

This describes the alleged method of infection for BadBIOS – spreading through imperceptible audio signals through the air rather than traditional internet/network connections. If true, this would be the first computer virus capable of such transmission.

💡Proof-of-concept

The narrator notes how many of BadBIOS' reported capabilities, like spreading via sound, seem more like proof-of-concept experiments than something that would exist in the real world, further casting doubt.

💡Contradictory claims

One reason for skepticism over BadBIOS is that some of its capabilities as described by the original developer contain contradictory elements, like needing infected USB drives to spread but also transmitting via sound signals, that don't fully make logical sense.

Highlights

BadBIOS malware allegedly spread between computers via sound frequencies humans can't hear

Dragos Ruiu first reported BadBIOS in 2013 when his computers exhibited strange behavior

BadBIOS supposedly infects Mac, Windows, Linux and BSD systems and persists after wiping drives

BadBIOS transmits through computer speakers and microphones via inaudible frequencies

Communicating data via sound is possible but challenging due to signal degradation

Background noise can interfere with sound data transmission between computers

Computers need protocols to listen for and interpret sound data transmission

BIOS systems are secure, so unlikely malware could access to transmit itself

BadBIOS inconsistencies have led some to believe it's an elaborate hoax

BadBIOS would be extremely expensive and time consuming to create

No definitive evidence exists proving or disproving BadBIOS

BadBIOS remains controversial - some believe, others skeptical

Online communities exist investigating and hypothesizing about BadBIOS

BadBIOS capabilities and existence remain a complete mystery

BadBIOS parallels 1990s virus hoaxes but more sophisticated

Transcripts

            Since the dawn of time,  the world has been filled with threats 

(EXPLOSION) and those who try to  

understand them. And this applies to the digital  world as well, and there was certainly a time,  

not too long ago in fact, where most people  didn’t understand these threats at ALL. So,  

throughout the 1990s, on the NEW worldwide web,  you end up having these mass panics of computer  

viruses with alleged capabilities that go beyond  the screen, almost SUPERNATURAL. And of course,  

many people rode on these fears either in jest  or to obtain some kind of control on those who  

are gullible. Just like how the satirical tabloid  “Weekly World News” once published a story about  

a computer virus that can spread to humans.  Because that’s ridiculous! We all know how a  

computer virus works, it’s a malicious piece of  code that is able to replicate itself and infect  

other computers on the same network, whether  it’s the internet or some kind of local network,  

where it can then do whatever it is programmed  TO do. And that’s the key, you need SOME kind  

of connection to another computer. It’s  not a REAL virus in the literal sense;  

it can’t SPREAD through the AIR…right?             Well in October of 2010,  

something very unnerving allegedly happened. A man  named Dragos Ruiu, the main developer behind the  

annual Pwn2Own hacking competition. He had just  installed a new copy of Mac OS X on his MacBook  

Air, and it was then that he started to notice  the computer suddenly had a mind of its own. For  

starters, his CD drive was no longer working,  he couldn’t boot from any CD placed into his  

system. He thought okay, maybe this was just a  hardware issue, but then noticed that all of his  

system configurations kept undoing themselves. His  system data then started getting deleted. He was  

starting to think that this wasn’t a hardware  issue, but instead some kind of malware. So he  

went ahead and completely wiped the hard drive and  reinstalled the operating system, but sure enough,  

the problem still persisted. As it turned out,  this issue wasn’t coming from the hard drive,  

but the BIOS, the motherboard of the computer,  meaning that even a full system restore couldn’t  

fix it. But it doesn’t even stop there. He noticed  that this malware was now spreading across other  

computers on his network, even ones with different  operating systems. He quickly disconnected them  

from his network, but it just kept going. And  so, as a last resort, he disabled his Wi-Fi  

and Bluetooth and even unplugged the power from  his wall, relying only on the battery. This is a  

technique called “air-gapping,” as these computers  were now completely independent from one another,  

in their own separate worlds…yet the virus was  still spreading, even to computers who were never  

connected to the internet in the first place.             The malware became known as  

“BadBIOS,” which was capable of infecting  Mac, Windows, Linux, and BSD systems,  

and word quickly started getting around the  internet that it may just be the very first  

instance of a computer virus spreading through  the air, quite literally. Through its strange,  

completely unknown engineering, it was somehow  able to bypass these “air gaps.” Surprisingly, it  

gets even weirder…actual word of the virus seems  to have spread faster than the virus itself, and  

that’s because we...don’t even know if it exists.  BadBIOS has become an incredibly controversial,  

divisive subject within niche parts of the tech  community, with some people swearing by it,  

others scoffing at how ridiculous it is, and then  those who believe it to be nothing more than an  

elaborate hoax. And today, we are going to talk  about this strange origin story. This is BadBIOS,  

the world’s most mysterious computer virus. Now browsing the internet can be quite scary,  

but you know what's even scarier? Googling  yourself and finding out that your personal  

information has been publicly compromised. Well,  good thing Aura, which is today's sponsor, is  

here to help you with that. Now, what is Aura, you  ask? Well, thank you for asking; no one asks about  

Aura. Having personal data exposed isn't even  just a privacy issue; it also affects your daily  

life through unending Robo calls or spam emails. Aura is a service that finds these data brokers  

that are using and selling your information and  sends out takedown requests so that they can,  

well, leave you alone. These brokers are legally  obligated to remove your info upon request, so why  

not have Aura do all that for you? But it doesn't  just do that; Aura also serves as an antivirus,  

VPN, and password management tool all in one  program. It also offers things like identity  

theft insurance, as well as parental controls  features for any parents that want to protect  

their children from unsafe content. And it  includes all these features for just one price. 

I began using it and was able to scan my computer  for any malware, as well as use its VPN feature,  

allowing me to use the internet anonymously. It  really is a great all-in-one security bundle.  

And if you go to [aura.com/nationsquid],  you can get two weeks completely free and  

see if any of your information has, in fact,  been compromised. So, protect your data and  

your online presence today through Aura.             Now, tracing the origins to  

BadBIOS is seemingly impossible, as there is  quite literally no prior documentation prior to  

Ruiu’s claims from 2013, (the year he first posted  about it) and he himself is unsure of where this  

strange malware came from. Consequently,  this makes the entire story a “he said,  

she said” situation, which is the main thing that  has raised many eyebrows about its authenticity;  

there’s no way for it to be tested. And  all that doubt is for good reason! I mean,  

a computer virus that can infect ANY operating  system and still shows up even AFTER wiping the  

computer clean and can still transmit without  an internet connection? That’s every computer  

user’s worst nightmare. It sounds a little  too over the top to be true. But surprisingly,  

this is NOT the first time that something like  this has happened. To be clear, really the only  

way a virus would be able to reinstall itself even  after the drive was completely wiped would be if  

it was installed anywhere else other than the  hard drive. In this case, Ruiu claims the virus  

was installed within the BIOS, hence the name,  meaning that it was installed on the MOTHERBOARD,  

not the hard drive. This is the main reason why  it can infect virtually any computer regardless  

of its operating system or if the system is  restored, as those things aren’t really relevant  

to begin with. Now BIOS malware is INCREDIBLY  rare, to the point where it is almost unheard of,  

and this is because of the fact that nearly every  computer’s BIOS is different. That virus would  

have to be programmed and tailored for that  specific BIOS, which is already programmed  

and tailored for that specific computer. Not  to mention this type of malware would also need  

backdoor access to the BIOS in order to flash it,  which if you’re using a company like AMD, that is  

definitely going to be something that’s encrypted. BIOS malware was more common back in the 80s and  

90s when there were a lot less options to choose  from computer wise and when encryption technology  

wasn’t NEARLY as secure. Most computers nowadays  don’t even use a BIOS, but instead a UEFI,  

which offers more features and enhances hardware  performance, but the general concepts do still  

apply. UEFIs will not update properly unless  they get a digital signature that’s actually  

from the manufacturer, which means that if  malware were to sneak in there, this would  

be caught right away. If these private signature  keys were to somehow get leaked to the public,  

then yes you could have a problem. The malware  developer could very well “forge” this signature  

so to speak and create a fake update with this  bad code, but these leaks are quite rare and  

even if they did occur, these companies have  protocols in place to quickly fix things. Now,  

I did want to acknowledge the distinction between  BIOS and UEFI systems, but they are often used  

interchangeably in the everyday language, for the  sake of simplicity, I will be referring to it as  

a BIOS throughout this video. But in short, even  if there was some extremely sophisticated BIOS  

malware that DID exist and somehow bypassed  these backdoors, it just wouldn’t be able to  

spread that far, BECAUSE of these limitations.  There’s only ONE Microsoft Windows, there’s only  

one Mac OS. There’s like a million different  types of BIOS. If a malware developer wants to  

target a specific computer, it is much easier to  just think of a smarter way to do it through the  

operating system; it’s simply just not worth it. Now in order for this to be considered a “virus”  

in the technical sense, it needs to be “spread”  itself and communicate to another computer. So,  

how do you do that through the BIOS? Moreover, how  was it able to communicate to other computers in  

the room that had no internet connection,  no Bluetooth, no physical connection,  

not even connected to a charger in the wall! Yet  they still caught it. The first airborne computer  

virus. This was the version of the story that  made all the headlines and a mystery that took  

years for Dragos himself to figure out. So how  did it work? Well, the virus spread…through sound.  

Dragos alleges that the virus transmitted its code  through the computer’s speakers and the computers  

in the other room were able to pick it up through  their microphones, but these sounds are played at  

high frequencies that our ears cannot hear. This idea probably sounds so ridiculous and  

over the top, like something out of some crappy  detective show. But it technically is…possible.  

Now, the actual programming and engineering of  such a virus that sends and receives data this way  

would be VERY complicated and frankly I don’t even  fully understand it myself. I’m not a programmer.  

I run a tech channel and I don’t know how to code.  I’m like that guy that wears Nirvana T-shirts and  

is like “Oh, I LOVE Nirvana! They make the BEST  clothes!’ Anyway, the point is I am omitting a  

lot of important technical details here, BUT the  basic concept of how transmitting data works is  

actually remarkable simple. And because…I’m the  creative type (wink), I’m gonna use an example  

of this that makes the most sense to me. We’re  gonna be transmitting pictures using sound. (SHOW)  

Communicating information with sound is not at  all unheard of. We’ve been doing it for hundreds  

of years. The telegraph systems in days of old  used dits and dahs against pieces of metal to  

communicate letters and numbers. A very primitive  example of dating real world information,  

modulating it into something objective and more  tangible, and turning it back into that real  

information on the other side, for the receiving  human to understand. And this approach has…kind  

of just stuck ever since. It’s actually quite  similar to how dial-up worked back in the 1990s.  

Those irritating sounds you heard logging on are  literally the modem and your computer TALKING to  

each other through sound. These special sounds  communicated protocols that the modem and computer  

were programmed to understand, allowing them  to “essentially” negotiating what your internet  

speed was going to be, letting you online! This  didn’t necessarily HAVE to be played out loud,  

but doing so did provide helpful diagnostic  information in case the user needed to fix  

anything on their end. But in short, communicating  data with sound is not weird at all. In fact,  

you’re even doing it right now…well, sort of. If you’ve seen my video about the history of  

the internet, I provide a very basic explanation  of how this works. Computers are basically SUPER  

advanced telegraph machines. But instead of  using morse code, they use something called  

binary. As we know, binary is a language made up  of 1s and 0s, a high electrical voltage means 1,  

low or none means 0. And it does all of this  almost instantaneously. If you’re on Wi-Fi, the  

same concept applies but instead with radio waves.  1 and 0 would be on slightly separate frequencies  

that are distinct enough for the computers to  understand. But instead of sound waves, they are  

electromagnetic waves, and instead of speakers,  they are modems, Wi-Fi cards, etc. But the general  

concept still applies, and these are frequencies  our bodies cannot see or hear, making it look like  

magic. So the virus is basically doing exactly  this, but instead of pictures, it’s binary,  

a binary version of the malicious code, and the  sound is playing at frequencies that we can’t  

hear, but the computers can, which the listening  computer takes in and translates. But sometimes it  

IS audible. Dragos himself complained of hearing  a high pitched noise in his lab and it took him  

THREE YEARS to find out that THIS was what was  happening. So yes, this is all very much possible. 

But there are problems with this approach. Sound  waves in general, just aren’t nearly as good with  

this kind of communicating. Using the Audacity  example, when I transmitted this image this way,  

there is a clear sign of degradation, loss of  quality compared to the original, and this is  

because of something called a “signal to noise”  ratio. You’re probably well aware that microphones  

can often pick up sounds that we either tend to  ignore or can’t even at all. You’ve ever noticed  

how you could be in a room that is just so quiet  and you can hear your voice clearly, but as soon  

as you record yourself talking, you hear all this  loud static in the background, yuck just sounds  

terrible. This is of course “background noise”  and the more there is, the more it is going to  

interfere with that data, and sound in particular  is VERY sensitive to background noise. This is why  

a lot of old school modems had these insolated  cups around their microphones and speakers,  

it was specifically to eliminate this background  noise. I tried this experiment again but put my  

laptop in the other room, and sure enough the  image quality was even WORSE. The distance and  

more added background noise of just the ambience,  my ceiling fan, all that stuff, were external  

factors that interfered with the transmission of  the image. Just how like the farther you are away  

from a Wi-Fi router, the weaker the connection.  It’s the same thing. But again, things like Wi-Fi,  

Bluetooth, stuff like that communicate using  electromagnetic waves. A speaker is essentially  

just a translator. It’s taking these electrical  signals from the computer and turning them IN to  

sound that we humans can hear. Wi-Fi and Bluetooth  are straightforward for data transmission,  

as it just needs to modulate the data and then  demodulate it when it reaches the recipient. A  

speaker in this case, would have modulate, then  demodulate, and then modulate again, and then  

demodulate again…yeah. It’s kind of like making a  photocopy of something and then making a photocopy  

of THAT photocopy and you just kept doing that.  The quality is just gonna get worse and worse. And  

if the data being sent is distorted enough, the  computer’s just not gonna know what to do with it.  

Computers are much more objective problem solvers,  much more sensitive to accurate information than  

we are. If I cover part of this picture of me with  my thumb, I still know that it’s a picture of me,  

but if I cover part of this QR code, it’s no  longer recognizable. In other words, even the  

SMALLEST bit of interference with this form of  transmission could lead to failure. Some kind  

of data loss through this type of communication  is pretty much inevitable. If you REALLY wanted  

to minimize the level of background noise and  interference, you would basically need to have  

these two computers in some kind of anechoic  chamber, not a busy coffee shop, and out of  

these two places, let’s be honest, where are  you more likely to find someone with a computer? 

But let’s say you SOMEHOW found a way around  this, and figured out a way to transmit this  

information to ALL these computers,  without any interference. Even then,  

how would you know that the other computers are  even listening? The reason this image was able to  

show up on my computer was because I had Audacity  open; it’s recording software that’s specifically  

programmed to record and look for patterns from  the sounds in my environment, hence why these  

images show up. If I just left my computer as is  and played this sound, it would just sit there,  

because it is not being told at that present  moment to do something with that information.  

The same applies with transmitting this code. You  can’t just DO that. The computer would need some  

kind of protocol that programs it to listen for  it. It’s one of the big reasons why that one scene  

in Bones is so ridiculous, where a computer  literally BLEW up because one of the bones  

it scanned had malware sketched into it. Wait. Why is it on LiveLeak? (laughing) 

What? (laughing) What?! 

(EXPLOSION) “Oh my God!” 

“Whoever did this wrote malware on bone and  destroyed a million bucks worth of computers.” 

“I DID NAHT. OH HAI MARK!” Yes, it is technically “scanning” something,  

but the code on its own doesn’t mean anything.  The computer actually has to be taught how to  

do something with it. It’s like if I walked up  to somebody that only speaks English and started  

speaking in French telling them to go make me a  sandwich. Yes, they can see that I’m speaking to  

them, but they don’t know what I am saying (SHOW).  But if that person decided to take French classes,  

well…I like extra mustard. Computers are the  same way. They have to learn or be “programmed”  

to actually execute this code. The 3D Scanner  in Bones likely wasn’t programmed to execute  

something resembles code that may or may not show  up on a bone. But if the hacker somehow got a hold  

of the scanner’s source code and found some kind  of vulnerability that says to execute THIS script  

if it finds THIS pattern during a scan, then…sure,  that’s plausible. I don’t think the computer would  

blow up though. [EXPLOSION] 

The same thing applies to BadBIOS; and because  BIOS and UEFI systems are so secure and locked  

down, the odds of a malware developer getting  access to the source code of not just one but  

nearly every BIOS to ever exist, is virtually  zero. But Dragos himself said that as soon as  

he unplugged his speakers, the data  transmission stopped. In other words,  

it couldn’t have transmitted through sound at  all without the computer already having been  

programmed to listen and be on the lookout for  this specific code from the malware, beforehand.  

Which implies that it spread through another way.  Dragos claims that as soon as he completely wiped  

the BIOS clean, the malware would still show  up again, and after further investigation,  

he concluded that as soon as he plugged in a  USB, the infection immediately started again. So,  

it seems most likely that Dragos somehow had  dozens of his USB drives infected with this  

malware and when he plugged these drives into  the other computers, they got infected as well,  

which allowed for these computers to  listen for these transmissions. But again,  

that still doesn’t account for the fact  that all these computers run a different  

BIOS and that BIOS would be locked down. This whole story has left so many people  

online scratching their heads. A story based on  so many proof-of-concepts that, at face value,  

sound straight out of science fiction as well  as things that are flat out contradictory. The  

whole thing sounds like something from a badly  written TV show, but Dragos is not some nobody,  

he is quite well respected, reputable individual  within his field, and other reputable sources who  

work with him have confirmed its validity as well.  Which is why so many people are both mystified  

and starting to think that this may be part of  an elaborate hoax, or some kind of prank. For  

the longest time, Dragos never actually provided  evidence outside of his written entries about it,  

which left people very skeptical, and when he  finally did post something, people claimed it  

wasn’t really anything that unusual. Some of  them even hypothesized that the sounds he was  

hearing were just coming from his hardware and  that he was trying to find things that weren’t  

there. Not to mention that this type of malware  would be INCREDIBLY expensive and time-consuming  

to create. If it did exist, it would be even  more advanced than Stuxnet, which took multiple  

people years to put together and costed tens of  millions of dollars. Just doesn’t seem likely. 

To this day, BadBIOS has earned a very mixed  reputation with the tech space. Many of those  

laughing at the absurdity, those on the fence who  are simply trying to learn more, and those who  

swear that its real and claim to have experienced  themselves. There are even entire communities  

around it. For now, BadBIOS remains a complete  mystery both in its capabilities and whether or  

not it even exists. Perhaps we’ve come full circle  to all the virus hoax shenanigans the internet saw  

back in the 90s, but manifested in a much more  convincing and well thought out way. Remarkable. 

But there is ONE thing that will FOR SURE  protect you from this malware if it does in  

fact exist…and it’s through becoming a Patreon  or channel member. Just click “join” or go to  

Patreon.com/NationSquid. Trust me! It works! A special thanks to my patrons and channel  

members for making this video possible. Thank you  so much for watching! If you enjoyed this video,  

please subscribe, and click the notification  bell, so that you never miss a future video.