English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Highly privileged software, such as firmware, is an attractive target forattackers. Thus, BIOS vendors use cryptographic signatures to ensure firmwareintegrity at boot time. Nevertheless, such protection does not prevent anattacker from exploiting vulnerabilities at runtime. To detect such attacks, wepropose an event-based behavior monitoring approach that relies on an isolatedco-processor. We instrument the code executed on the main CPU to sendinformation about its behavior to the monitor. This information helps toresolve the semantic gap issue. Our approach does not depend on a specificmodel of the behavior nor on a specific target. We apply this approach todetect attacks targeting the System Management Mode (SMM), a highly privilegedx86 execution mode executing firmware code at runtime. We model the behavior ofSMM using invariants of its control-flow and relevant CPU registers (CR3 andSMBASE). We instrument two open-source firmware implementations: EDK II andcoreboot. We evaluate the ability of our approach to detect state-of-the-artattacks and its runtime execution overhead by simulating an x86 system coupledwith an ARM Cortex A5 co-processor. The results show that our solution detectsintrusions from the state of the art, without any false positives, whileremaining acceptable in terms of performance overhead in the context of the SMM(i.e., less than the 150 $\mu$s threshold defined by Intel).

Co-processor-based Behavior Monitoring: Application to the Detection of Attacks Against the System Management Mode