Full disk encryption anti-malware scan
A computer device, system, and method are provided for leveraging the Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during computer startup, enhancing security by identifying and mitigating malware threats before the main operating system is loaded. To do so, a processor circuitry of the computer device identifies indicators for objects stored in a targeted memory to be scanned. The processor circuitry sends the indicators to a reputation service via a communication interface and receives feedback concerning whether the objects are malicious, suspicious, or benign.
1 . A computer device leveraging a Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during startup, the computer device comprising:
a communication interface configured to communicate with a reputation service using a network configuration;
processing memory comprising a temporary non-transitory computer readable medium;
storage memory comprising a non-transitory computer readable medium including:
disk partitions comprising an EFI (Extensible Firmware Interface) system partition (ESP) and at least one other disk partition storing an operating system, wherein the operating system comprises operating system files including a registry; and
a cache configured to store previous scans of targeted memory, wherein:
each of the stored previous scans includes at least one previous indicator associated with at least one previous verdict received from the reputation service; and
the targeted memory includes at least one of the ESP, at least one of the disk partitions, the registry of the operating system files, or the processing memory; and
processor circuitry configured to:
before loading the stored operating system, scan the targeted memory for malware by:
identifying indicators for objects stored in the targeted memory;
for each of the identified indicators:
before sending the identified indicator to the reputation service, search in the cache for a matching identified indicator;
when the matching identified indicator is not found in the cache:
sending the identified indicator to the reputation service via the communication interface; and
receiving via the communication interface feedback from the reputation service, wherein:
the feedback includes a verdict;
the verdict is associated with the identified indicator;
the identified indicator is associated with the stored object, such that the verdict is associated with at least one of the stored objects;
the verdict identifies the associated at least one of the stored objects as malicious, suspicious, or benign; and
when the matching indicator is found in the cache, apply to the identified indicator the verdict associated with the matching identified indicator; and
load the stored operating system based on the received feedback.
2 . The computer device of claim 1 , wherein the loading of the stored operating system based on the received feedback includes quarantining any of the at least one stored object identified as malicious.
3 . The computer device of claim 1 , wherein the indicators include at least one of a file hashes, file names, directory names, registry keys, or registry values stored in the targeted memory.
4 . The computer device of claim 1 , wherein the network configuration includes at least one of network credentials, a list of one or more trusted certificate authorities (CAs), or connection information for a virtual local area network (VLAN) having access to limited external services including the reputation service.
5 . The computer device of claim 1 , wherein the processor circuitry is further configured to:
run an agent on the loaded operating system, such that the agent obtains the network configuration from the operating system; and
provide the obtained network configuration to the communication interface.
6 . The computer device of claim 1 , wherein the communication interface is configured to receive the network configuration from a policy server.
7 . The computer device of claim 1 , wherein:
the communication interface communicates with the reputation service using an application programming interface (API); and
the processor circuitry is further configured to batch indicators before sending to the reputation service, such that a plurality of indicators are sent to the reputation service in a single call to the API.
8 . The computer device of claim 1 , wherein the processor circuitry is further configured to limit scanning to a limited set of objects stored in the storage memory and processing memory, such that the scanning of the targeted memory has a limited time duration.
9 . The computer device of claim 1 , wherein one or more peripheral devices are communicatively connected to the computer device and the scanned targeted memory includes the peripheral devices.
10 . The computer device of claim 1 , wherein the reputation service comprises at least one of a local database, a remote database, or a remote service.
11 . A method performed by a computer device for leveraging a Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during startup, the method comprising:
before loading with processor circuitry of the computer device an operating system stored in a storage memory of the computer device, scanning for malware with the processor circuitry a targeted memory of the computer device by:
identifying indicators for objects stored in the targeted memory;
for each of the identified indicators:
before sending the identified indicator to a reputation service, searching in a cache for a matching identified indicator;
when the matching identified indicator is not found in the cache:
sending the identified indicator to the reputation service via a communication interface of the computer device;
receiving via the communication interface feedback from the reputation service, wherein:
the feedback includes a verdict;
the verdict is associated with the identified indicator;
the identified indicator is associated with the stored object, such that the verdict is associated with at least one of the stored objects;
the verdict identifies the associated at least one of the stored objects as malicious, suspicious, or benign; and
the storage memory is a non-transitory computer readable medium including:
disk partitions comprising an EFI (Extensible Firmware Interface) system partition (ESP) and at least one other disk partition storing an operating system; and
the cache configured to store previous scans of the targeted memory, wherein:
each of the stored previous scans includes at least one previous indicator associated with at least one previous verdict received from the reputation service;
each of the at least one previous verdict identifies the associated at least one previous indicator as malicious, suspicious, or benign;
the operating system comprises operating system files including a registry;
processing memory comprising a temporary non-transitory computer readable medium;
the targeted memory includes at least one of the ESP, the at least one disk partition, the registry of the operating system files, or the processing memory; and
when the matching indicator is found in the cache, applying the at least one verdict associated with the matching identified indicator to the identified indicator; and
loading with the processor circuitry the stored operating system based on the received feedback.
12 . The method of claim 11 , wherein the loading of the stored operating system based on the received feedback includes quarantining any of the at least one stored object identified as malicious.
13 . The method of claim 11 , wherein the indicators include at least one of a file hashes, file names, directory names, registry keys, or registry values stored in the targeted memory.
14 . The method of claim 11 , wherein the network configuration includes at least one of network credentials, a list of one or more trusted certificate authorities (CAs), or connection information for a virtual local area network (VLAN) having access to limited external services including the reputation service.
15 . The method of claim 11 , further comprising:
running with the processor circuitry an agent on the loaded operating system, such that the agent obtains the network configuration from the operating system; and
the processor circuitry providing the obtained network configuration to the communication interface.
16 . A system for leveraging a Full Disk Encryption (FDE) pre-boot environment to conduct anti-malware scans during startup, the system comprising:
a reputation service comprising computer hardware including a computer processor;
a computer device comprising:
a communication interface configured to communicate with the reputation service using a network configuration;
processing memory comprising a temporary non-transitory computer readable medium;
storage memory comprising a non-transitory computer readable medium including:
disk partitions comprising an EFI (Extensible Firmware Interface) system partition (ESP) and at least one other disk partition storing an operating system, wherein the operating system comprises operating system files including a registry; and
a cache configured to store previous scans of targeted memory, wherein:
each of the stored previous scans includes at least one previous indicator associated with at least one previous verdict received from the reputation service; and
the targeted memory includes at least one of the ESP, at least one of the disk partitions, the registry of the operating system files, or the processing memory; and
processor circuitry configured to:
before loading the stored operating system, scan the targeted memory for malware by:
identifying indicators for objects stored in the targeted memory; and
for each of the identified indicators:
before sending the identified indicator to the reputation service, search in the cache for a matching identified indicator;
when the matching identified indicator is not found in the cache:
sending the identified indicator to the reputation service via the communication interface;
when the matching indicator is found in the cache, apply to the identified indicator the verdict associated with the matching identified indicator;
wherein the computer processor of the reputation service is configured to:
receive the sent indicators;
analyze the received indicators to determine feedback, wherein:
the feedback includes at least one verdict;
the at least one verdict is associated with at least one indicator of the sent indicators;
each of the indicators is associated with at least one of the stored objects, such that the at least one verdict is associated with at least one of the stored objects; and
the at least one verdict identifies the associated at least one of the stored objects as malicious, suspicious, or benign; and
send the determined feedback to the computer device;
wherein the processor circuitry of the computer device is further configured to:
receive via the communication interface the sent feedback; and
load the stored operating system based on the received feedback.
17 . The system of claim 16 , wherein:
the reputation service includes memory storage comprising a non-transitory computer readable medium and storing a database associating known indicators with known verdicts, such that each of the stored known indicators is associated with a known verdict;
the analyzing of the received indicators to determine feedback comprises:
comparing each of the received indicators to the database; and
applying the associated known verdict to a received indicator when the received indicator matches one of the stored known indicators.
18 . The system of claim 16 , wherein:
the reputation service includes memory storage comprising a non-transitory computer readable medium and storing a machine learning algorithm trained to generate a verdict based on an input indicator; and
the analyzing of the received indicators to determine feedback comprises:
applying the machine learning algorithm to each of the received indicators, such that the machine learning algorithm outputs the generated verdict for each of the received indicators; and
applying the generated verdict to each of the received indicators.