Detecting security threats by monitoring chains of configuration changes made to basic input/output system (BIOS) or unified extensible firmware interface (UEFI) attributes
Systems and methods for detecting IHS attacks by monitoring chains of configuration changes made to Basic Input/Output System (BIOS) or Unified Extensible Firmware Interface (UEFI) attributes are described. In some embodiments, an IHS may include a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: monitor a chain of BIOS/UEFI configuration changes; compare the chain of BIOS/UEFI configuration changes against an Indication of Attack (IoA); and report an alert in response to the chain of BIOS/UEFI configuration changes matching the IoA.
1. An Information Handling System (IHS), comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to:
monitor a chain of Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) configuration changes comprising at least an indication of a first configuration change having a first timestamp followed by a second configuration change having a second timestamp;
compare, against an Indication of Attack (IoA) comprising at least an indication of a third configuration change followed by a fourth configuration change after a time interval: (i) the first configuration change against the third configuration change, and (ii) the second configuration change against the fourth configuration change; and
report an alert in response to a determination that: (i) the first configuration change is equal to the third configuration change, (ii) the second configuration change is equal to the fourth configuration change, and (iii) a difference between the second timestamp and the first timestamp is equal to or less than the time interval.
2. The IHS of claim 1 , wherein to monitor the chain of BIOS/UEFI configuration changes, the program instruction, upon execution, further cause the IHS to access a non-volatile memory (NVM) where BIOS configuration attributes are stored.
3. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a disablement of BIOS signing, followed by an enablement of BIOS downgrade, followed by a disablement of BIOS auto-recovery, followed by an enablement of BIOS auto-recovery, followed by a disablement of BIOS downgrade, and followed by an enablement of BIOS signing.
4. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a selection of a legacy boot option from a boot list, followed by a disablement of secure boot, followed by an attempt to perform a legacy boot.
5. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a selection of a Secure Digital (SD) boot option, a Thunderbolt boot option, or a Universal Serial Bus (USB) boot option from a boot list, followed by an addition of a boot device to the boot list.
6. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a disablement of boot path security, followed by at least one of: a disablement of a secure boot, or an attempt to perform a legacy boot.
7. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a disablement of a BIOS integrity check, followed by an enablement of BIOS downgrade, followed by a firmware update, followed by a disablement of BIOS auto-recovery.
8. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a bypass of a physical presence requirement for a Trusted Platform Module (TPM), followed by a TPM operation.
9. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: an allowance of a Trusted Platform Module (TPM) clearing operation, followed by at least one of: an allowance of a local TPM activation, or an allowance of a remote TPM activation operation.
10. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: an enablement an auto-on feature, an auto-on wake-on-Local Area Network (LAN) feature, an Universal Serial Bus (USB)-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, (ii) an allowance of a remote Trusted Platform Module (TPM) activation operation, or (iii) an allowance of a remote wipe of an internal drive.
11. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: an enablement an auto-on feature, an auto-on wake-on-Local Area Network (LAN) feature, an Universal Serial Bus (USB)-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, or (ii) an allowance of a remote Trusted Platform Module (TPM) activation operation.
12. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: an enablement a microphone or camera, followed by an enablement of an auto-on microphone or camera setting.
13. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a change to a minimum length of an admin password, followed by a disablement of a strong password feature, followed by an admin password change.
14. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: an admin password change, followed by an enablement of an admin setup lockout feature.
15. The IHS of claim 1 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of: a removal of an intrusion warning, followed by a chassis intrusion reset.
16. A hardware memory device having program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS), cause the IHS to:
monitor a chain of Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) configuration changes comprising at least an indication of a first configuration change having a first timestamp followed by a second configuration change having a second timestamp;
compare, against an Indication of Attack (IoA) comprising at least an indication of a third configuration change followed by a fourth configuration change after a time interval: (i) the first configuration change against the third configuration change, and (ii) the second configuration change against the fourth configuration change; and
report an alert in response to a determination that: (i) the first configuration change is equal to the third configuration change, (ii) the second configuration change is equal to the fourth configuration change, and (iii) a difference between the second timestamp and the first timestamp is equal to or less than the time interval.
17. A method, comprising:
monitoring a chain of Basic Input/Output System (BIOS)/Unified Extensible Firmware Interface (UEFI) configuration changes comprising at least an indication of a first configuration change having a first timestamp followed by a second configuration change having a second timestamp;
comparing, against an Indication of Attack (IoA) comprising at least at least an indication of a third configuration change followed by a fourth configuration change after a time interval: (i) the first configuration change against the third configuration change, and (ii) the second configuration change against the fourth configuration change; and
reporting an alert in response to a determination that: (i) the first configuration change is equal to the third configuration change, (ii) the second configuration change is equal to the fourth configuration change, and (iii) a difference between the second timestamp and the first timestamp is equal to or less than the time interval.
18. The hardware memory device of claim 16 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of at least one of:
(a) a disablement of BIOS signing, followed by an enablement of BIOS downgrade, followed by a disablement of BIOS auto-recovery, followed by an enablement of BIOS auto-recovery, followed by a disablement of BIOS downgrade, and followed by an enablement of BIOS signing;
(b) a selection of a legacy boot option from a boot list, followed by a disablement of secure boot, followed by an attempt to perform a legacy boot;
(c) a selection of a Secure Digital (SD) boot option, a Thunderbolt boot option, or a Universal Serial Bus (USB) boot option from a boot list, followed by an addition of a boot device to the boot list;
(d) a disablement of boot path security, followed by at least one of: a disablement of a secure boot, or an attempt to perform a legacy boot;
(e) a disablement of a BIOS integrity check, followed by an enablement of BIOS downgrade, followed by a firmware update, followed by a disablement of BIOS auto-recovery;
(f) a bypass of a physical presence requirement for a Trusted Platform Module (TPM), followed by an a TPM operation;
(g) an allowance of a TPM clearing operation, followed by at least one of: an allowance of a local TPM activation, or an allowance of a remote TPM activation operation;
(h) an enablement an auto-on feature, an auto-on wake-on-Local Area Network (LAN) feature, an USB-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, (ii) an allowance of a remote TPM activation operation, or (iii) an allowance of a remote wipe of an internal drive;
(i) an enablement an auto-on feature, an auto-on wake-on-LAN feature, an USB-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, or (ii) an allowance of a remote TPM activation operation;
(j) an enablement a microphone or camera, followed by an enablement of an auto-on microphone or camera setting;
(k) a change to a minimum length of an admin password, followed by a disablement of a strong password feature, followed by an admin password change;
(l) an admin password change, followed by an enablement of an admin setup lockout feature; or
(m) a removal of an intrusion warning, followed by a chassis intrusion reset.
19. The method of claim 17 , wherein the chain of BIOS/UEFI configuration changes comprises an indication of at least one of:
(a) a disablement of BIOS signing, followed by an enablement of BIOS downgrade, followed by a disablement of BIOS auto-recovery, followed by an enablement of BIOS auto-recovery, followed by a disablement of BIOS downgrade, and followed by an enablement of BIOS signing;
(b) a selection of a legacy boot option from a boot list, followed by a disablement of secure boot, followed by an attempt to perform a legacy boot;
(c) a selection of a Secure Digital (SD) boot option, a Thunderbolt boot option, or a Universal Serial Bus (USB) boot option from a boot list, followed by an addition of a boot device to the boot list;
(d) a disablement of boot path security, followed by at least one of: a disablement of a secure boot, or an attempt to perform a legacy boot;
(e) a disablement of a BIOS integrity check, followed by an enablement of BIOS downgrade, followed by a firmware update, followed by a disablement of BIOS auto-recovery;
(f) a bypass of a physical presence requirement for a Trusted Platform Module (TPM), followed by an a TPM operation;
(g) an allowance of a TPM clearing operation, followed by at least one of: an allowance of a local TPM activation, or an allowance of a remote TPM activation operation;
(h) an enablement an auto-on feature, an auto-on wake-on-LAN feature, an USB-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, (ii) an allowance of a remote TPM activation operation, or (iii) an allowance of a remote wipe of an internal drive;
(i) an enablement an auto-on feature, an auto-on wake-on-LAN feature, an USB-wake feature, or a wake-on-Dock feature, followed by at least one of: (i) an allowance of a BIOS downgrade followed by a firmware update operation, or (ii) an allowance of a remote TPM activation operation;
(j) an enablement a microphone or camera, followed by an enablement of an auto-on microphone or camera setting;
(k) a change to a minimum length of an admin password, followed by a disablement of a strong password feature, followed by an admin password change;
(l) an admin password change, followed by an enablement of an admin setup lockout feature; or
(n) a clearing of an intrusion warning, followed by a chassis intrusion reset.