Systems and methods for detecting short-term changes to BIOS setup

An information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to, during a boot of the information handling system, determine whether a BIOS configuration change has been made during a current boot session of the information handling system, and responsive to determining that a BIOS configuration change has been made during the current boot session, store an indication of the BIOS configuration change to a non-volatile memory.

TECHNICAL FIELD

The present disclosure relates in general to information handling systems, and more particularly to detecting short-term changes to configuration setup of a basic input/output system of an information handling system.

BACKGROUND

As is known in the art, an information handling system may include a basic input/output system (BIOS). Generally speaking, a BIOS may include any system, device, or apparatus configured to identify, test, and/or initialize information handling resources of an information handling system. In some instances, a BIOS may include a Unified Extensible Firmware Interface (UEFI). A BIOS may comprise boot firmware configured to be the first code executed by an information handling system when the information handling system is booted and/or powered on. As part of its initialization functionality, code for a BIOS may be configured to set components of an information handling system into a known state, so that one or more applications (e.g., an operating system or other application programs) stored on compatible media may be executed by and given control of the information handling system.

Configuration settings for a BIOS can often be modified through a “BIOS setup” program. Typically, an individual physically present at an information handling system can enter BIOS setup by entering a defined hotkey and/or entering a defined set of keystrokes on a keyboard communicatively coupled to the information handling system during a particular portion of information handling system boot.

Unfortunately, in existing BIOS implementations, BIOS setup may be used by a malicious actor to commit malicious acts. A physically-present attacker may modify BIOS configuration via BIOS setup on an unattended information handling system to undertake malicious acts such as enabling unauthorized boot devices, setting or changing a BIOS password, and/or other acts. In existing approaches, on a normal boot cycle a setup configuration may be measured in platform configuration registers (PCRs) of a Trusted Platform Module or other cryptoprocessor and logged, but the state of such PCRs do not survive a reboot of the information handling system. Accordingly, an attacker may take advantage of this behavior to perpetrate an attack and then reset the configuration in setup (restoring setup state to the original configuration as it existed before the attack), thus removing any traces of the attack.

SUMMARY

In accordance with the teachings of the present disclosure, the disadvantages and problems associated with ensuring security of BIOS configuration may be reduced or eliminated.

In accordance with embodiments of the present disclosure, an information handling system may include a processor and a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system. The BIOS may be further configured to, during a boot of the information handling system, determine whether a BIOS configuration change has been made during a current boot session of the information handling system, and responsive to determining that a BIOS configuration change has been made during the current boot session, store an indication of the BIOS configuration change to a non-volatile memory.

In accordance with these and other embodiments of the present disclosure, a method may include, during a boot of an information handling system having a basic input/output system (BIOS) comprising a program of instructions executable by the processor and configured to cause the processor to initialize one or more information handling resources of the information handling system, determining, by the BIOS, whether a BIOS configuration change has been made during a current boot session of the information handling system, and responsive to determining that a BIOS configuration change has been made during the current boot session, storing, by the BIOS, an indication of the BIOS configuration change to a non-volatile memory.

In accordance with these and other embodiments of the present disclosure, an article of manufacture may include a non-transitory computer readable medium and computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, during a boot of an information handling system: determine, by a basic input/output system (BIOS) of the information handling system configured to cause the processor to initialize one or more information handling resources of the information handling system, whether a BIOS configuration change has been made during a current boot session of the information handling system; and responsive to determining that a BIOS configuration change has been made during the current boot session, store, by the BIOS, an indication of the BIOS configuration change to a non-volatile memory.

DETAILED DESCRIPTION

Preferred embodiments and their advantages are best understood by reference toFIGS. 1 and 2, wherein like numbers are used to indicate like and corresponding parts.

FIG. 1illustrates a block diagram of an example information handling system102, in accordance with embodiments of the present disclosure. In some embodiments, information handling system102may comprise a server. In other embodiments, information handling system102may be a personal computer (e.g., a desktop computer, a laptop, notebook, tablet, handheld, smart phone, personal digital assistant, etc.). As depicted inFIG. 1, information handling system102may include a processor103, a memory104communicatively coupled to processor103, basic input/output system (BIOS)108communicatively coupled to processor103, network interface112communicatively coupled to processor103, a cryptoprocessor114communicatively coupled to processor103, a user interface116communicatively coupled to processor103, and one or more other information handling resources118communicatively coupled to processor103.

BIOS108may be communicatively coupled to processor103and may include any system, device, or apparatus configured to identify, test, and/or initialize information handling resources of information handling system102. “BIOS” may broadly refer to any system, device, or apparatus configured to perform such functionality, including without limitation, a Unified Extensible Firmware Interface (UEFI). In some embodiments, BIOS108may be implemented as a program of instructions that may be read by and executed on processor103to carry out the functionality of BIOS108. In these and other embodiments, BIOS108may comprise boot firmware configured to be the first code executed by processor103when information handling system102is booted and/or powered on. As part of its initialization functionality, code for BIOS108may be configured to set components of information handling system102into a known state, so that one or more applications (e.g., an operating system or other application programs) stored on compatible media (e.g., memory104) may be executed by processor103and given control of information handling system102.

Network interface112may include any suitable system, apparatus, or device operable to serve as an interface between information handling system102and a network coupled thereto. Network interface112may enable information handling system102to communicate over network108using any suitable transmission protocol and/or standard, including without limitation, Fibre Channel, Frame Relay, Asynchronous Transfer Mode (ATM), Internet protocol (IP), or other packet-based protocol. Network interface112may be configured to communicate to via wireless transmissions, wired communications, and/or optical transmissions.

Cryptoprocessor114may be communicatively coupled to processor103and/or BIOS108(e.g., via a suitable communication bus) and may include any system, device, or apparatus configured to carry out cryptographic operations on data communicated to it from processor103, BIOS108, and/or another component of information handling system102. In some embodiments, cryptoprocessor114may be compliant with the Trusted Platform Module specification, a successor specification, and/or any other similar specification. In some embodiments, cryptoprocessor114may be configured to generate random numbers, generate encryption keys (e.g., RSA keys), generate and maintain hash key tables of hardware and software components of information handling system102, generate and maintain configuration parameters associated with hardware and software components of an information handling system, wrap (e.g., encrypt) keys, unwrap (e.g., decrypt) keys, and/or store keys (e.g., endorsement key, storage root key, attestation identity keys, storage keys).

As shown inFIG. 1, cryptoprocessor114may comprise a non-volatile memory115accessible only to cryptoprocessor114. Memory115may comprise any system, device, or apparatus configured to retain program instructions or data for a period of time (e.g., computer-readable media). Memory115may comprise non-volatile random access memory (NVRAM), EEPROM, a PCMCIA card, flash memory, magnetic storage, opto-magnetic storage, or any suitable selection and/or array of non-volatile memory that retains data after power to information handling system102is turned off.

User interface116may comprise any instrumentality or aggregation of instrumentalities by which a user may interact with information handling system102. For example, user interface116may permit a user to input data and/or instructions into information handling system102, and/or otherwise manipulate information handling system102and its associated components. User interface116may also permit information handling system102to communicate data to a user, e.g., by way of a display device.

In operation, in accordance with embodiments of the present disclosure, BIOS108and cryptoprocessor114may operate in concert to log changes to BIOS configuration and event logs of cryptoprocessor114in a manner that survives reboots of information handling system102. Such logging of changes and event logs may be invisible to a user or malicious attacker and may allow a verifier (e.g., an administrator or software configured to analyze such logging for indicators of attack) in order to detect short-term BIOS configuration changes that may comprise a short-lived attack. Example functionality of BIOS108and cryptoprocessor114in this regard is described in greater detail below in reference to method200.

FIG. 2illustrates a flow chart of an example method200for detecting short-term changes to BIOS setup, in accordance with embodiments of the present disclosure. According to one embodiment, method200may begin at step202. As noted above, teachings of the present disclosure may be implemented in a variety of configurations of information handling system102.

At step202, information handling system102may boot and BIOS108may initialize.

At step204, BIOS108may determine if an event log change flag is set in non-volatile memory (e.g., within a non-volatile portion of memory104) of information handling system102. As described below, such a flag may be set during a prior boot session of information handling system102responsive to a BIOS configuration change being made in the prior boot session. If the event log change flag is set, method200may proceed to step216. Otherwise, method200may proceed to step206.

At step206, BIOS108may determine if a BIOS configuration change has been made during the current boot session of information handling system102. If a BIOS configuration change has been made during the current boot session of information handling system102, method200may proceed to step208. Otherwise, method200may end (e.g., which may result in continued execution of BIOS108and a boot to an operating system of information handling system102).

At step208, responsive to a BIOS configuration change having been made during the current boot session of information handling system102, BIOS108may create a record of the changed configuration and write it to a non-volatile index within memory115of cryptoprocessor114. Having been written to a non-volatile index within memory115of cryptoprocessor114, the record of the changed configuration may be protected by a platform hierarchy of cryptoprocessor114.

At step210, BIOS108may create a copy of the BIOS event log for the current boot session and generate a fingerprint (e.g., a hash) of the BIOS event log.

At step212, BIOS108may store the event log in non-volatile memory (e.g., within a non-volatile portion of memory104) of information handling system102.

At step213, BIOS108may write the fingerprint of the BIOS event log to the non-volatile index within memory115of cryptoprocessor114.

At step214, BIOS108may set the event log change flag in non-volatile memory (e.g., within a non-volatile portion of memory104) of information handling system102to indicate a BIOS configuration change being made in the current boot session of information handling system102. After completion of step214, method200may end (e.g., which may result in continued execution of BIOS108and a boot to an operating system of information handling system102).

At step216, in response to the event log change flag being set in non-volatile memory (e.g., thus indicating a BIOS configuration having been made in the prior boot session) of information handling system102, BIOS108may create a copy of the new BIOS event log for the current boot session, and append the new BIOS event log to the previously stored event log in non-volatile memory (e.g., within a non-volatile portion of memory104) of information handling system102.

At step218, BIOS108may generate a fingerprint (e.g., a hash) of the new BIOS event log and write such fingerprint to the non-volatile index within memory115of cryptoprocessor114.

At step220, BIOS108may determine if a BIOS configuration change has been made during the current boot session of information handling system102. If a BIOS configuration change has been made during the current boot session of information handling system102, method200may proceed to step208. Otherwise, method200may proceed to step222.

At step222, BIOS108may reset the event log change flag in non-volatile memory of information handling system102(e.g., thus indicating no BIOS configuration having been made in the current boot session). After completion of step222, method200may end (e.g., which may result in continued execution of BIOS108and a boot to an operating system of information handling system102).

AlthoughFIG. 2discloses a particular number of steps to be taken with respect to method200, method200may be executed with greater or lesser steps than those depicted inFIG. 2. In addition, althoughFIG. 2discloses a certain order of steps to be taken with respect to method200, the steps comprising method200may be completed in any suitable order.

Method200may be implemented using information handling system102or any other system operable to implement method200. In certain embodiments, method200may be implemented partially or fully in software and/or firmware embodied in computer-readable media.