TECHNICAL FIELD

The present disclosure relates to the protection of electronic devices from firmware attacks, and in particular relates to automatically deriving benchmark measurements with which to compare firmware measurements.

BACKGROUND

There are increasing attacks on the BIOS (Basic Input/Output System) in electronic computing devices, such as the implanting of rootkits in the BIOS. If the BIOS on a PC (Personal Computer) endpoint is compromised with a rootkit, there is no convenient or automated way at any given point of time to check its integrity and perform remediation. Nevertheless, one way to check integrity of the firmware is to compare a measurement of it with a golden measurement obtained from the manufacturer, but this is not always possible or desirable. Firmware checking applications that use golden measurements must be updated with new golden measurements at the same time that the firmware is updated, otherwise legitimate firmware changes will be unnecessarily and widely reported as suspect. Golden measurements must be made in exactly the same way as the firmware measurements that are compared with the golden measurements. The National Institute of Standards and Technology (NIST) has published a conceptual draft relating to BIOS integrity, entitled “BIOS Integrity Measurement Guidelines” (Publication number 800-155). However, the extent of its implementation is unknown as of the time of writing.

SUMMARY

In order to recognize attacks on a device's firmware, measurements of the firmware are made regularly and compared with prior firmware measurements and/or silver measurements. Silver measurements, which are reputation based measurements, are derived from a set of identical firmware measurements obtained from multiple devices having the same make, model and firmware version number. The comparison of firmware measurements enables additional reporting to users and IT administrators, to alert them about firmware changes. The firmware integrity status may be reported, for example, on a data and device security console for a group of managed endpoints. Real-time alerts can be sent to the IT administrators and end users when firmware updates are detected on their endpoints. Alerts about firmware changes, which may be potential attacks on the firmware, can be given automatically.

An advantage of the invention is that the integrity of the firmware of a device can be checked without having to obtain a golden measurement from the manufacturer, or without manually or otherwise making a golden measurement. The applications that perform the firmware checks do not need to be manually or automatically updated with golden measurements. Instead, the invention detects changes across multiple devices and automatically determines whether the changes are genuine or suspect. Another advantage is that firmware roll-backs can be detected and reported. The embodiments disclosed herein each provide one or more of the above advantages.

Disclosed herein is a method for protecting electronic devices comprising: receiving, by a server from each of a first threshold number of electronic devices, an identically performed firmware measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; determining, by the server, that at least a second threshold number of the received firmware measurements are identical; defining, by the server, one of said identical firmware measurements to be a silver measurement; receiving, by a processor, from a further electronic device having the identical make, identical model and firmware with the identical version number, a further identically performed firmware measurement; and comparing the further firmware measurement with the silver measurement.

Also disclosed herein is a system for protecting electronic devices comprising a server; a processor in the server; and a non-transient computer readable memory in the server that stores instructions, which, when executed by the processor, cause the server to: receive from each of a first threshold number of electronic devices, an identically performed firmware measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; determine that at least a second threshold number of the received firmware measurements are identical; define one of said identical firmware measurements to be a silver measurement; receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware measurement; and compare the further firmware measurement with the silver measurement.

Still further disclosed herein is a non-transient computer readable medium that stores instructions, which, when executed by a processor, cause the processor to: receive from each of a first threshold number of electronic devices, an identically performed firmware measurement, wherein said devices have an identical make, an identical model and a firmware with an identical version number; determine that at least a second threshold number of the received firmware measurements are identical; define one of said identical firmware measurements to be a silver measurement; receive, from a further electronic device having the identical make, identical model and identical firmware version, a further identically performed firmware measurement; and compare the further firmware measurement with the silver measurement.

This summary is not an extensive overview intended to delineate the scope of the subject matter that is described and claimed herein. The summary presents aspects of the subject matter in a simplified form to provide a basic understanding thereof, as a prelude to the detailed description that is presented below. Neither this summary, the drawings nor the following detailed description purport to define or limit the invention; the invention is defined only by the claims.

