Story image

CrowdStrike integrates firmware attack detection in endpoint protection

03 May 2019

Modern security tools have focused on detecting attacks at the operating system (OS) level and above, but provide little visibility into lower levels of the modern computing platform.

Attackers looking to maintain stealth and persistence have targeted the BIOS to infect it with malicious code that is difficult to detect and can persist despite reboots and reinstallation of the operating system.

These malicious firmware updates can be delivered via standard intrusion techniques, such as spearphishing, or come pre-installed on a machine via attacks on the supply chain, making these threat vectors especially difficult to detect and mitigate.

As supply chain attacks from nation-states and other cybercriminals persist in plaguing organisations and government agencies, continuous monitoring and enhanced detection below the OS-level is necessary for improved IT hygiene.

Today, most security products remain blind to attacks that attempt to leverage BIOS firmware to infiltrate endpoints, leaving organisations vulnerable to compromise.

CrowdStrike is aiming to change this paradigm.

Falcon will be the first endpoint protection platform to provide visibility into these threats, enabling organisations to thwart BIOS attacks while continuously monitoring endpoints.

Falcon collects details on BIOS images and configuration and delivers enterprise-wide firmware visibility via the cloud-native Falcon Platform console.

In addition, through an integration with Dell SafeBIOS, CrowdStrike enables stronger detection for BIOS/firmware based threats on Dell systems.

CrowdStrike Falcon aims to improve IT hygiene through visibility over the assets, applications, and accounts being used in an organisation’s environment, improving overall security posture and helping businesses take a more proactive stance to security.

“Today’s persistent nation-state actors have already begun migrating to BIOS attacks as their next preferred environment for persistence and malicious control of systems.

“With security researchers and companies around the world showcasing various attacks against Intel Boot Guard, Secure Boot, Intel CSME, AMD PSP and other core platform security technologies, it’s only a matter of time until such techniques become commoditised by an even wider spectrum of attackers,” says CrowdStrike EDR strategy vice president Alex Ionescu.

CrowdStrike is planning on releasing the results of its research, as well as the unique technology it uses to capture firmware data, at future cybersecurity conferences around the world.

Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
One Identity named Leader in PAM and IAM by KuppingerCole
KuppingerCole lead analyst Anmol Singh evaluated the strengths and weaknesses of 20 solution providers in the PAM market for the report.
Healthcare environments difficult to secure - Forescout
The convergence of IT, Internet of Things (IoT) and operational technology (OT) makes it more difficult for the healthcare industry to manage a wide array of hard-to-control network security risks.