abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

Firmware Tamper Detection

Modifications to system firmware should be detected by the system. Depending on the type of firmware tampering, detection is a very hard problem, however, certain mechanisms can and should be implemented:
  • Verification of timing anomalies which can be induced by interception/eavesdropping
  • Verification of state anomalies, e.g. content of certain HW-related ports/registers
  • For very high protection need, the deployment of dedicated co-processors with the purpose of software integrity verification.
  • https://downloads.cloudsecurityalliance.org/assets/research/internet-of-things/future-proofing-the-connected-world.pdf
  • http://phrack.org/issues/66/11.html
  • http://www.co-c.net/repository-securite-informatique/Papers/SMM-Rootkits-Securecom08.pdf
  • https://www.mitre.org/sites/default/files/publications/Copernicus2-SENTER-the-Dragon-CSW-.pdf
  • https://firmware.intel.com/sites/default/files/resources/Platform_Security_Review_Intel_Cisco_White_Paper.pdf

Further Reading:

THREATS
SERVICES
  • ​Detailed Analysis
  • Services Overview
  • Secure Firmware Update
  • Minimal Hardware Access
  • Lock Logical Access
  • Secure Code Review
  • Firmware Tamper Detection
  • Customer Validation Tools
  • Removing Management Backdoors
  • User Awareness Process
  • Secure Key Storage
  • Default Configuration Analysis
  • Data Encryption - At Rest & In Transit
  • Remote Wiping
COMPLIANCE STANDARDS & GUIDELINES
  • Overview
  • NIST
  • ISO/IEC
  • ENISA
  • HIPAA
  • FFIEC
  • UEFI.org
COMPANY
  • About Us
  • Contact
  • Management Team  
All rights reserved © 2017