A vulnerability residing in a bare-metal cloud server that enables attackers to implant a malicious backdoor in its firmware to bypass security and monitor user activity.

A vulnerability residing in a bare-metal cloud server that enables attackers to implant a malicious backdoor in its firmware to bypass security and monitor user activity.

• A. Supply Chain Attack
• B. Cloudborne Attack
• C. DoS
• D. Firmware Rootkit

Answer: (B)

A backdoor implanted in the firmware of a bare-metal cloud server is a firmware rootkit. This type of malware lives in the device’s firmware (such as BIOS/UEFI or other hardware firmware) and runs before the operating system starts. Because it operates below the OS, it can bypass OS defenses, persist across reboots and even OS reinstallations, and quietly monitor activity or funnel data without being detected by normal security tools. In a cloud setting using bare-metal servers, such persistence means an attacker can maintain access across multiple workloads on that hardware, which makes the threat especially dangerous. Defenses focus on ensuring firmware integrity and trust: secure boot and measured boot to verify the chain of trust from the firmware upward, cryptographic signing of firmware updates, hardware-based root of trust, and firmware attestation. Regular firmware patching, strict access controls for flashing firmware, and robust supply-chain security help reduce the risk of this kind of compromise. Why this fits best: it directly describes malware embedded in the device’s firmware that enables a covert, persistent backdoor, which is the hallmark of a firmware rootkit. Other terms like DoS describe service disruption, while supply-chain concerns or cloud-specific terms don’t capture the mechanism of persistence and covert monitoring at the firmware level.

A backdoor implanted in the firmware of a bare-metal cloud server is a firmware rootkit. This type of malware lives in the device’s firmware (such as BIOS/UEFI or other hardware firmware) and runs before the operating system starts. Because it operates below the OS, it can bypass OS defenses, persist across reboots and even OS reinstallations, and quietly monitor activity or funnel data without being detected by normal security tools. In a cloud setting using bare-metal servers, such persistence means an attacker can maintain access across multiple workloads on that hardware, which makes the threat especially dangerous.

Defenses focus on ensuring firmware integrity and trust: secure boot and measured boot to verify the chain of trust from the firmware upward, cryptographic signing of firmware updates, hardware-based root of trust, and firmware attestation. Regular firmware patching, strict access controls for flashing firmware, and robust supply-chain security help reduce the risk of this kind of compromise.

Why this fits best: it directly describes malware embedded in the device’s firmware that enables a covert, persistent backdoor, which is the hallmark of a firmware rootkit. Other terms like DoS describe service disruption, while supply-chain concerns or cloud-specific terms don’t capture the mechanism of persistence and covert monitoring at the firmware level.