Statistical detection of firmware-level compromises
Statistical detection of firmware-level compromises can be enabled and performed on a computing system. During pre-boot, a pre-boot agent can access firmware loaded in memory and cause it to be stored in a manner that will allow the firmware to be accessed at runtime. During runtime, the firmware can be accessed and stored as files in the file system or other storage location accessible to an antivirus solution. The antivirus solution can then analyze the files using statistics-based techniques to thereby detect compromises in firmware.
1. A method for analyzing firmware, the method comprising:
during pre-boot, accessing firmware stored in one or more regions of memory;
during pre-boot, storing the firmware in one or more separate regions of memory that remain accessible at runtime;
during runtime, accessing the firmware that is stored in the one or more separate regions of memory; and
during runtime, storing the firmware as one or more files in a file system at a location accessible to an antivirus solution to thereby enable the antivirus solution to perform a statistical analysis on the one or more files to detect a compromise in the firmware.
2. The method of claim 1 , wherein the one or more regions of memory comprise at least one memory region that stores dynamic firmware.
3. The method of claim 2 , wherein the dynamic firmware includes firmware configuration settings.
4. The method of claim 1 , wherein storing the firmware in the one or more separate regions of memory comprises storing the firmware in one or more Advanced Configuration and Power Interface (ACPI) tables.
5. The method of claim 1 , wherein accessing the firmware that is stored in the one or more separate regions of memory comprises reading the firmware from the one or more ACPI tables.
6. The method of claim 1 , wherein storing the firmware in the one or more separate regions of memory comprises storing the firmware in an ACPI non-volatile (NV) region of memory.
7. The method of claim 6 , wherein accessing the firmware that is stored in the one or more separate regions of memory comprises reading the firmware from the ACPI NV region of memory.
8. The method of claim 1 , wherein the firmware comprises multiple portions of firmware, and wherein storing the firmware in the file comprises storing each portion of firmware as a separate file in the file system.
9. The method of claim 1 , further comprising:
accessing the file system to analyze the firmware.
10. The method of claim 9 , wherein the firmware is analyzed using a statistics-based technique.
11. The method of claim 1 , further comprising:
during a subsequent pre-boot:
accessing the firmware stored in one or more regions of memory;
storing the firmware in one or more separate regions of memory that remain accessible at runtime;
during a subsequent runtime corresponding to the subsequent pre-boot:
accessing the firmware that is stored in the one or more separate regions of memory; and
storing the firmware in the file system in conjunction with the firmware that was previously stored in the file system.
12. The method of claim 11 , further comprising:
accessing the file system to analyze the firmware that was stored during the subsequent runtime against the firmware that was previously stored in the file system.
13. One or more computer storage media storing computer executable instruction which when executed on a computing system implement a method for analyzing firmware, the method comprising:
during pre-boot, accessing one or more portions of firmware that are stored in one or more regions of memory;
during pre-boot, storing the one or more portions of firmware in memory in a manner that causes the one or more portion of firmware to remain accessible during runtime; and
during runtime, storing the one or more portions of firmware as one or more files in a file system to thereby enable an antivirus solution to perform a statistical analysis on the one or more files to detect a compromise in the firmware.
14. The computer storage media of claim 13 , wherein storing the one or more portions of firmware in memory in a manner that causes the one or more portion of firmware to remain accessible during runtime comprises one or more of:
storing the one or more portions of firmware in one or more Advanced Configuration and Power Interface (ACPI) tables; or
storing the one or more portions of firmware in an ACPI non-volatile (NV) region of memory.
15. The computer storage media of claim 13 , wherein the one or more portions of firmware that are stored in one or more regions of memory comprise firmware configuration settings.
16. The computer storage media of claim 13 , wherein storing the one or more portions of firmware in the file system comprises creating a separate file in the file system for each of the one or more portions of firmware.
17. The computer storage media of claim 13 , wherein the method further comprises:
accessing the file system to evaluate the one or more portion of firmware using a statistics-based technique.
18. A computing system comprising:
one or more processors; and
one or more computer storage media storing computer executable instructions which when executed by the one or more processors implement a method for enabling firmware to be analyzed at runtime, the method comprising:
loading, during pre-boot, a pre-boot agent;
identifying, by the pre-boot agent, a memory region that stores firmware;
causing, by the pre-boot agent and during pre-boot, the firmware stored in the memory region to be copied to a portion of memory that remains accessible at runtime;
accessing, at runtime and by a runtime agent, the portion of memory that remains accessible at runtime to obtain the firmware; and
storing the firmware as one or more files in a file system to thereby enable an antivirus solution to perform a statistical analysis on the one or more files to detect a compromise in the firmware.
19. The computing system of claim 18 , wherein the firmware comprises firmware configuration settings.
20. The computing system of claim 18 , wherein the portion of memory that remains accessible at runtime comprises an Advanced Configuration and Power Interface (ACPI) region of memory.