Boot security

1. A system, comprising:

a processor; and

a non-transitory computer readable medium comprising instructions that when executed on the processor cause the processor to perform steps comprising:

sending a request to a first device;

receiving first device information from the first device, the first device information comprising operating context information;

receiving a request from the first device;

in response to the request, sending a challenge to the first device;

in response to the challenge, receiving a first set of boot information from the first device and a cryptographic proof of the challenge, the first set of boot information including a list of boot items;

receiving a first attestation vector from the first device, the first attestation vector comprising one or more platform configuration register (PCR) values and a digital signature on at least one of the one or more PCR values;

verifying the list of boot items based on the first attestation vector;

determining a reputation for one or more boot items in the list of boot items, including determining a reputation for a given one of the one or more boot items based on a pattern of change over time for the given one of the one or more boot items as reported in an attestation for the given one of the one or more boot items from multiple devices; and

generating an alert based on the determined reputation.

2. A method for securing a device, comprising:

receiving a first set of boot information from a first device, the first set of boot information comprising a list of boot items;

receiving from the first device a first proof based on the first set of boot information;

verifying the first set of boot information based on the first proof;

determining a reputation for one or more boot items in the list of boot items, including determining a reputation for a given one of the one or more boot items based on a pattern of change over time for the given one of the one or more boot items as reported in an attestation for the given one of the one or more boot items from multiple devices; and

reporting the determined reputation, wherein reporting the determined reputation comprises causing a message to be sent to an administrator.

3. The method of claim 2 , further comprising receiving a request from the first device and in response to the request sending a challenge to the first device.

4. The method of claim 2 , wherein the first set of boot information includes a proof calculated on each boot item in the list of boot items.

5. The method of claim 2 , wherein the first set of boot information includes a device identifier.

6. The method of claim 2 , wherein the first set of boot information includes device platform information.

7. The method of claim 2 , wherein reporting the determined reputation comprises generating an alert upon determining that determined reputation meets a threshold for at least one of the one or more boot items in the list of boot items.

8. The method of claim 2 , wherein the reputation for the one or more boot items is based on a determined version.

9. The method of claim 2 , wherein the pattern of change for the at least one of the one or more boot items is based on timing of appearance of the at least one of the one or more boot items on multiple devices.

10. The method of claim 9 , wherein timing of appearance of the at least one of the one or more boot items on multiple devices is consistent with an update.

11. The method of claim 10 , wherein the update is a hardware update.

12. The method of claim 11 , wherein the hardware update includes a change in optional hardware or a change in components of hardware.

13. The method of claim 9 , wherein timing of appearance of the at least one of the one or more boot items on multiple devices is consistent with malware.

14. A computer program product embodied in a non-transitory computer readable medium that, when executing on a threat management facility, performs steps comprising:

receiving a first set of boot information from a first device, the first set of boot information comprising a list of boot items;

receiving from the first device a first proof based on the first set of boot information;

verifying the first set of boot information based on the first proof;

determining a reputation for one or more boot items in the list of boot items, including determining a reputation for a given one of the one or more boot items based on a pattern of change over time for the given one of the one or more boot items as reported in an attestation for the given one of the one or more boot items from multiple devices; and

reporting the determined reputation, wherein reporting the determined reputation comprises causing a message to be sent to an administrator.

15. The computer program product of claim 14 , wherein the first set of boot information includes a device identifier.

16. The computer program product of claim 14 , wherein the first set of boot information includes device platform information.

17. The computer program product of claim 14 , wherein reporting the determined reputation comprises generating an alert upon determining that determined reputation meets a threshold for at least one of the one or more boot items in the list of boot items.

18. The computer program product of claim 14 , wherein the pattern of change for the at least one of the one or more boot items is based on timing of appearance of the at least one of the one or more boot items on multiple devices.