CS SEMINAR

Validating Software Integrity Properties on Boot Firmware Images

Speaker
Dr Christophe Hauser, Information Sciences Institute, University of Southern California
Chaired by
Dr LIANG Zhenkai, Associate Professor, School of Computing
liangzk@comp.nus.edu.sg

19 Jul 2019 Friday, 02:00 PM to 03:30 PM

i4-01-03 Seminar Room

Abstract:

Boot firmware, like UEFI-compliant firmware, has been the target of numerous attacks, giving the attacker control over the entire system while being undetected. The measured boot mechanism of a computer platform ensures its integrity by using cryptographic measurements to detect such attacks. This is typically performed by relying on a Trusted Platform Module (TPM). Recent work, however, shows that vendors do not respect the specifications that have been devised to ensure the integrity of the firmware's loading process. As a result, attackers may bypass such measurement mechanisms and successfully load a modified firmware image while remaining unnoticed. In this paper we introduce BootKeeper, a static anal- ysis approach verifying a set of key security properties on boot firmware images before deployment, to ensure the integrity of the measured boot process. We evaluate BootKeeper against several at- tacks on common boot firmware implementations and demonstrate its applicability.


Biodata:

Christophe Hauser is a research computer scientist at the Information Sciences Institute (ISI) of University of Southern California (USC), where he co-leads the STEEL research group along with Jelena Mirkovic and Genevieve Bartlett. His research interests span across multiple areas of security, inluding binary program analysis for automated reverse engineering, software verification and vulnerability discovery. Previously, he was a postdoctoral researcher at University of California, Santa Barbara with Professors Giovanni Vigna and Christopher Kruegel where he worked on building parts of the "angr" binary analysis framework. He received his Ph.D. in computer science jointly from CentraleSupelec(France) and Queensland University of Technology (Australia).