Using trusted platform module to build real time indicators of attack information
Managed devices containing a Trusted Platform Module (TPM) to provide a trusted environment generate a device certificate at initialization of the TPM and send the device certificate to a management console for storing in a certificate database. Upon detecting a file of interest, the TPM signs the file, adding to a signature list created by previous managed devices. The signature list can be used to analyze the spread of the file across the system of managed devices, including tracking the file to the first managed device to have had a copy, without requiring real-time access to the managed devices during the spread of the file. In some embodiments, additional security measures may be taken responsive to determining the first managed device and the path the file has taken across the system of managed devices.
1. At least one non-transitory machine readable medium comprising instructions that, when executed, cause a machine to at least:
generate a first device certificate in a trusted environment on the machine;
send the first device certificate to a management console, the management console to manage the machine using a chain of device certificates including the first device certificate;
detect creation of a file on the machine;
sign the file using the first device certificate in the trusted environment to update the chain of device certificates in the file, the chain of device certificates to be formed from device certificates for devices including the machine on which the file has been present and managed by the management console to determine an origin and a spread pattern of the file across the devices on which the file has been present to form forensic evidence for identification of a source of malware infection by the management console;
store the signed file and associated chain of device certificates on the machine; and
perform, initiated by the management console, a security check of the file at the machine using the forensic evidence, the security check to identify tampering with the file and to trigger, by the management console when tampering is identified, corrective action on one or more affected devices according to the spread pattern.
2. The at least one machine readable medium of claim 1 , wherein the instructions, when executed, cause the machine to:
establish a connection between the trusted environment and the management console;
receive a request for the first device certificate from the management console via the connection; and
send the first device certificate to the management console via the connection responsive to the request.
3. The at least one machine readable medium of claim 1 , wherein the instructions, when executed, cause the machine to:
generate the first device certificate using a private key of the trusted environment.
4. The at least one machine readable medium of claim 1 , wherein the instructions, when executed, cause the machine to:
identify the file in a list of files.
5. The at least one machine readable medium of claim 1 , further including instructions that, when executed, cause the machine to:
perform security checks on the machine responsive to a request from the management console.
6. The at least one machine readable medium of claim 1 , wherein the instructions, when executed, cause the machine to:
preserve the chain of device certificates from other signing devices present in the file.
7. At least one non-transitory machine readable medium comprising instructions that, when executed, cause the machine to at least:
identify a plurality of managed devices;
receive a device certificate created in a trusted environment on the plurality of managed devices;
store the device certificate in a certificate database; and
evaluate a chain of signatures in a file of interest, the chain of signatures formed from device certificates for the plurality of managed devices where the file has been present, to:
determine a set of managed devices of the plurality of managed devices where the file has been present using the chain of signatures and device certificates obtained from the certificate database;
identify an earliest managed device of the set of managed devices using the chain of signatures to determine an origin and a spread pattern of the file across the managed devices on which the file has been present;
form forensic evidence using the file and the chain of signatures to identify a source of malware infection; and
perform a security check of the file at the machine using the forensic evidence, the security check to identify tampering with the file and to trigger, when tampering is identified, corrective action on one or more affected devices according to the spread pattern.
8. The at least one machine readable medium of claim 7 , further including instructions that, when executed, cause the machine to:
initiate a security check on managed devices in the set of managed devices.
9. The at least one machine readable medium of claim 7 , further including instructions that, when executed, cause the machine to:
initiate a security check on the earliest managed device of the set of managed devices.
10. The at least one machine readable medium of claim 7 , further including instructions that, when executed, cause the machine to:
preserve the file and chain of signatures as forensic evidence of a security incident.
11. A method of determining a source of infection in a plurality of managed devices, comprising:
collecting, via a management console, device certificates created in a trusted environment on the plurality of managed devices;
storing the device certificate in a certificate database associated with the management console, the management console to manage the plurality of managed devices using the certificate database;
analyzing an infected file by at least:
retrieving certificates from the certificate database corresponding to certificates in a chain of certificates in the infected file, the chain of certificates formed from device certificates for the managed devices on which the infected file has been present;
identifying a path of managed devices from a first managed device to a second managed device using the chain of certificates in the infected file to determine an origin and a spread pattern of the infected file across the managed devices on which the file has been present, the infected file and the chain of certificates forming forensic evidence to identify a source of infection; and
performing security checks on the first managed device using the forensic evidence,
the security checks to identify tampering with the infected file and to trigger, when tampering is identified, corrective action by the management console on one or more affected devices according to the spread pattern.
12. The method of claim 11 , further including:
preserving the infected file as forensic evidence of an attack.
13. The method of claim 11 , wherein retrieving certificates from the certificate database includes:
obtaining public keys associated with the retrieved certificates.
14. The method of claim 13 , wherein collecting device certificates includes:
establishing a connection with a trusted environment on the plurality of managed devices;
requesting a device certificate from the trusted environment on the plurality of managed devices; and
receiving the device certificate via the connection responsive to the request.
15. A management console system, comprising:
a processing element;
a memory, coupled to the processing element, including instructions that, when executed, cause the processing element to:
collect a plurality of device certificates created in a trusted environment on a plurality of managed devices, the device certificates created in the trusted environment on the managed device associated with the respective device certificate;
analyze a chain of signatures in a file, signatures in the chain of signatures signed with a private key of a respective managed device of the plurality of managed devices;
validate the signatures using a public key associated with a respective device certificate of the plurality of device certificates;
form forensic evidence using the file and the chain of signatures to identify a source of malware infection;
determine which managed devices of the plurality of managed devices have signed the file by analyzing the chain of signatures in the file to determine an origin and a spread pattern of the file across the devices on which the file has been present to identify the source of malware infection; and
perform a security check of the file using the forensic evidence, the security check to identify tampering with the file and to trigger, when tampering is identified, corrective action on one or more affected devices according to the spread pattern.
16. The management console system of claim 15 , wherein the processing element is to:
identify an earliest managed device of the plurality of managed devices that signed the file.
17. The management console system of claim 15 , wherein the processing element is to:
store the plurality of device certificates in a certificate database.
18. The management console system of claim 15 , wherein the processing element is to:
initiate a security action on at least some of the plurality of managed devices that signed the file.
19. The management console system of claim 15 , wherein the processing element is to:
initiate a security action on an earliest managed device of the plurality of managed devices that signed the file.
20. The management console system of claim 19 , wherein the processing element is to:
search for other files signed with the device certificate of the earliest managed device on other managed devices of the plurality of managed devices; and
perform a security action on the other managed devices.
21. A managed programmable device, comprising:
a processing element;
a trusted environment, coupled to the processing element;
a memory, coupled to the trusted environment, including instructions that, when executed, cause the trusted environment to:
generate, in the trusted environment on the managed programmable device, a device certificate signed by a private key of the trusted environment to provide to a management console device, the management console device to manage the managed programmable device using a chain of device certificates including the device certificate;
receive information about a new file from the processing element;
sign the new file using the private key of the trusted environment to update the chain of device certificates in the file, the chain of device certificates to be formed from device certificates for devices on which the file has been present and managed by the management console device to determine an origin and a spread pattern of the file across the devices on which the file has been present, the chain of device certificates to form forensic evidence using the file and the chain of device certificates to identify a source of malware infection; and
perform, initiated by the management console, a security check of the file using the forensic evidence,
the security check to identify tampering with the file and to trigger, when tampering is identified, corrective action by the management console device on one or more affected devices according to the spread pattern.
22. The managed programmable device of claim 21 , further including instructions that, when executed, cause the trusted environment to:
receive a request for the device certificate from a management console device;
generate the device certificate signed by the private key of the trusted environment, responsive to the request; and
send the device certificate to the management console device.
23. The managed programmable device of claim 21 , wherein the instructions, when executed, cause the trusted environment to:
embed the device certificate signed with the private key of the trusted environment in the new file.
24. The managed programmable device of claim 21 , wherein the instructions, when executed, cause the trusted environment to:
store the device certificate signed with the private key of the trusted environment as an extended attribute of the new file.
25. The managed programmable device of claim 21 , further including instructions that, when executed, cause the processing element to:
notify the trusted environment of the new file; and
store the signed new file in a file system associated with the managed programmable device.