Method for logging firmware attack event and system therefor
A violation of a firmware access rule is detected, and an entry is generated at a log file stored at a baseboard management controller, the entry identifying the violation. In an embodiment, detecting the violation is in response to receiving a system management interrupt at an information handling system.
1. A method comprising:
receiving a system management interrupt (SMI) at an information handling system;
executing an SMI handler in response to receiving the SMI, the SMI handler defining a list of firmware access rules identifying potentially malicious activity;
detecting by the SMI handler a violation of a firmware access rule included at the list; and
generating an entry at a log file stored at a memory included at a baseboard management controller, the entry identifying the violation.
2. The method of claim 1 , further comprising generating an electronic mail message informing a user of the information handling system that the violation has been detected.
3. The method of claim 1 , wherein the violation comprises an attempt to perform a write operation at a firmware memory after the memory has been declared as read-only.
4. The method of claim 1 , wherein the violation comprises a failure to authenticate a payload containing a firmware image or a failure to authenticate a variable to be stored at a firmware memory.
5. The method of claim 1 , wherein the violation comprises determining that there is insufficient space at a firmware memory to store a variable.
6. The method of claim 1 , wherein the violation comprises detecting a buffer overrun that would result in modification of system management mode program instructions.
7. The method of claim 1 , wherein the violation comprises determining whether a system management interrupt handler is attempting to execute instructions at a memory address that is not included at a region of system memory corresponding to a system management mode.
8. The method of claim 1 , wherein the log file is a system event log.
9. An information handling system comprising:
a processor;
a system memory device; and
a firmware memory device for storing firmware, the firmware including instructions to:
receive a system management interrupt (SMI) at an information handling system;
execute an SMI handler in response to receiving the SMI, the SMI handler defining a list of firmware access rules identifying potentially malicious activity;
detect by the SMI handler a violation of a firmware access rule included at the list; and
generate an entry at a log file stored at a memory included at a baseboard management controller, the entry identifying the violation.
10. The system of claim 9 , further comprising instructions to generate an electronic mail message informing a user of the information handling system that the violation has been detected.
11. The system of claim 9 , wherein the violation comprises an attempt to perform a write operation at a firmware memory after the memory has been declared as read-only.
12. The system of claim 9 , wherein the violation comprises a failure to authenticate a payload containing a firmware image or a failure to authenticate a variable to be stored at a firmware memory.
13. The system of claim 9 , wherein the violation comprises determining that there is insufficient space at a firmware memory to store a variable.
14. The system of claim 9 , wherein the violation comprises detecting a buffer overrun that would result in modification of system management mode program instructions.
15. The system of claim 9 , wherein the violation comprises determining whether a system management interrupt handler is attempting to execute instructions at a memory address that is not included at a region of system memory corresponding to a system management mode.
16. The system of claim 9 , wherein the log file is a system event log.
17. A non-transitory data storage medium storing instructions executable by a processor to cause the processor to:
receive a system management interrupt at an information handling system;
execute an SMI handler in response to receiving the SMI, the SMI handler defining a list of firmware access rules identifying potentially malicious activity;
detect by the SMI handler a violation of a firmware access rule included at the list; and
generate an entry at a log file stored at a memory included at a baseboard management controller, the entry identifying the violation.
18. The medium of claim 17 , further comprising instructions to generate an electronic mail message informing a user of the information handling system that the violation has been detected.
19. The method of claim 1 , further comprising blocking modification of firmware in response to the detecting.
20. The system of claim 9 , further comprising instructions to block modification of firmware in response to the detecting.