AU2007202250B2 - Method and system to scan firmware for malware - Google Patents

Abstract

A method, system and computer program product for scanning firmware of a processing system for malware. The method (400) includes obtaining a copy of firmware stored in the processing system (410); and analysing the copy of the firmware to determine if the firmware has been modified or infected by malware (420). -4/5 Obtain a copy of firmware stored in ---- 410 the processing system Analyse the copy of the firmware to determine if the firmware has been 420 modified by malware Store uncompromised firmware -- 510 Obtain a copy of firmware stored in 520 the processing system Analyse the copy of the firmware to determine if the firmware has been 530 modified by malware Retrieve the uncompromised 540 firmware. Repair the firmware using the 550 uncompromised firmware

Description

AUSTRALIA PATENTS ACT 1990 COMPLETE SPECIFICATION NAME OF APPLICANT(S):: PC Tools Technology Pty Limited ADDRESS FOR SERVICE: DAVIES COLLISON CAVE Patent Attorneys 255 Elizabeth Street, Sydney, New South Wales, Australia, 2000 INVENTION TITLE: Method and system to scan firmware for malware The following statement is a full description of this invention, including the best method of performing it known to me/us: 5102 - 1 METHOD AND SYSTEM TO SCAN FIRMWARE FOR MALWARE Copyright [001] A portion of the disclosure of this patent document contains material that is subject 5 to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent disclosure, as it appears in a Patent Office patent files or records, but otherwise reserves all copyrights whatsoever. Technical Field 10 [002] The present invention generally relates to a method, system and/or computer readable medium of instructions for scanning firmware of a processing system for malware, and removing malware from the firmware of the processing system. Background Art 15 [003] As used herein a "threat" includes malicious software, also known as "malware" or "pestware", which includes software that is included or inserted in a part of a processing system or processing systems for a harmful purpose. The term threat should be read to include possible, potential and actual threats. Types of malware can include, but are not limited to, malicious libraries, viruses, worms, Trojans, adware, malicious active content 20 and denial of service attacks. In the case of invasion of privacy for the purposes of fraud or theft of identity, malicious software that passively observes the use of a computer is known as "spyware". [004] An entity can include, but is not limited to, a file, an object, a class, a collection of 25 grouped data, a library, a variable, a process, and/or a device. [005] Flash memory is a form of EEPROM (Electrically Erasable Programmable Read Only Memory) that allows multiple locations of memory to be erased or written in one programming operation. Examples of components of a processing system which utilise 30 Flash memory include the System BIOS, Video card firmware, and Optical storage firmware.

-2 [006] System BIOS (b(asic) i(nput/)o(utput) systemm) is a set of routines stored in read only/flash memory that enable a computer to start the operating system and to communicate with the various devices in the system, such as disk drives, keyboard, monitor, printer, and communications ports. 5 [007] Firmware is software that is embedded in a hardware device of the processing system. Hardware devices which include firmware are referred throughout the specification as firmware devices. Firmware is often provided on Flash ROMS or as a binary image file that can be uploaded onto existing hardware. An example of firmware is 10 the BIOS of a processing system. [008] A cryptographic hash function is a mathematical function that maps values from a large (or even very large) domain into a smaller range, and is a one-way function in that it is computationally infeasible to find any input which maps to any pre-specified output. 15 Furthermore, the function is collision-free in that it is computationally infeasible to find any two distinct inputs which map to the same output. [009] A checksum is a digit representing the sum of the digits in an instance of digital data. The checksum can be used to check whether errors have occurred in transmission or 20 storage. [010] Disassembly, in computer programming, is the result when machine code is translated back into assembly language. The term can also refer to the process of creating the disassembly, i.e. using and interacting with a disassembler. 25 [011] A System Administrator is a person in charge of managing and maintaining a computer system. [012] In a networked information or data communications system, a user has access to 30 one or more terminals which are capable of requesting and/or receiving information or data from local or remote information sources. In such a communications system, a terminal may be a type of processing system, computer or computerised device, personal computer (PC), mobile, cellular or satellite telephone, mobile data terminal, portable computer, -3 Personal Digital Assistant (PDA), pager, thin client, or any other similar type of digital electronic device. The capability of such a terminal to request and/or receive information or data can be provided by software, hardware and/or firmware. A terminal may include or be associated with other devices, for example a local data storage device such as a hard 5 disk drive or solid state drive. A terminal is broadly herein referred to as a processing system. [013] An information source can include a server, or any type of terminal, that may be associated with one or more storage devices that are able to store information or data, for 10 example in one or more databases residing on a storage device. The exchange of information (ie. the request and/or receipt of information or data) between a terminal and an information source, or other terminal(s), is facilitated by a communication means. The communication means can be realised by physical cables, for example a metallic cable such as a telephone line, semi-conducting cables, electromagnetic signals, for example 15 radio-frequency signals or infra-red signals, optical fibre cables, satellite links or any other such medium or combination thereof connected to a network infrastructure. [014] Current malware scanning engines scan the file system of a processing system (i.e. the hard drive of the processing system) and input storage mediums (such as a Compact 20 Disk or Floppy Disk) which can be read by input devices of the processing system (such as a Compact Disk Drive or a Floppy Disk Drive). [015] Due to current malware scanning practices, authors of malware have been seeking alternate methods to infect a processing system with malware which may not be easily 25 detected. One such alternate method is to modify the firmware of one or more EEPROM devices of the processing system. As EEPROM devices are generally used prior to the processing system booting to an operating system, malware that modifies an EEPROM device can effect low level functionality of the processing system. 30 [016] Furthermore, if a user suspects that the firmware of an EEPROM device has been altered by malware, the user must delete the modified firmware from the EEPROM device and reinstall the correct firmware. The reinstallation process of an EEPROM device generally requires the user to have a detailed knowledge of the specific EEPROM device.

C \NRPonb\DCC\WFSW010424_1 DOC-23/I1/2011 -4 If the user, for example, attempts to reinstall the incorrect firmware for a BIOS of a processing system, the BIOS chip or the motherboard can be rendered useless, thus requiring the user to purchase a new BIOS chip or motherboard for the processing system. 5 [017] Therefore, there exists a need for a method, system, computer readable medium of instructions, and/or a computer program product to scan firmware of a processing system for malware which addresses or at least ameliorates problems inherent in the prior art. [018] There also exists a need for a method, system, computer readable medium of 10 instructions, and/or a computer program product to repair firmware which has been damaged by malware which addresses or at least ameliorates problems inherent in the prior art. [019] The reference in this specification to any prior publication (or information derived 15 from it), or to any matter which is known, is not, and should not be taken as an acknowledgment or admission or any form of suggestion that that prior publication (or information derived from it) or known matter forms part of the common general knowledge in the field of endeavour to which this specification relates. 20 Disclosure Of Invention [020] In one broad form there is provided a method of scanning firmware of a processing system for malware, wherein the method includes: obtaining a list of firmware devices in communication with the processing system; obtaining a copy of firmware stored in the processing system for at least one 25 firmware device in the list; and analysing the copy of the firmware for the at least one firmware device to determine if the firmware has been modified by malware. [021] In one form, the method includes: 30 storing uncompromised firmware; and in the event that malware has been determined to have modified the copy of the firmware, repairing the firmware using the uncompromised firmware. [022] In another form, the step of analysing the copy of the firmware is performed using 35 a detection module, wherein the detection module includes a plurality of submodules -5 including at least one of a cryptographic hash module, a checksum module, a disassembly module, and a pattern matching module, wherein the method includes analysing, using the plurality of submodules, the copy of the firmware to determine if the firmware has been modified by malware. 5 [023] Optionally, the method includes: generating, using the cryptographic hash module, a cryptographic hash value of the copy of the firmware; and comparing the cryptographic hash value to a database to determine whether the 10 firmware has been modified by malware, wherein the database includes a plurality of cryptographic hash values indicative of at least one of malicious entities and non-malicious entities. [024] In one embodiment, the method includes: 15 generating, using the checksum module, a checksum value of the copy of the firmware; and comparing the checksum value to a list to determine whether the entity is malicious, wherein the list includes a plurality of checksum values associated with at least one or malicious entities and non-malicious entities. 20 [025] In another embodiment, wherein the method includes: disassembling, using the disassembly module, at least a portion of the copy of the firmware; and performing a comparison, using the pattern matching module, between the 25 disassembled entity and a list of patterns associated with malicious activity. [026] In an optional embodiment, in the event the analysis indicates that the firmware has not been modified by malware, the method includes storing an uncompromised copy of the firmware. 30 [027] In one form, in the event the analysis indicates that the firmware has been modified by malware, the method includes: retrieving the uncompromised copy of the firmware; and C \NRPonbl\DCC\HFS\40)M24- DOC.23/11/201 -6 copying the uncompromised copy of the firmware for a firmware device containing the modified firmware. [028] In another form, the method includes iteratively analysing the firmware for each 5 firmware device in the list. [029] In one aspect the method includes: retrieving the uncompromised copy of the firmware for a firmware device; and performing a comparison between the firmware of the firmware device and the 10 retrieved uncompromised copy of the firmware to determine if the firmware has been modified by malware. [030] In another aspect, in the event that the firmware is determined to have been modified by malware, the method includes: 15 generating a report indicating that a firmware device includes firmware modified by malware; and transferring the report to a server processing system. [031] In one embodiment, the report is indicative of: 20 the copy of the modified firmware; a firmware device identity; a firmware device associated with the firmware; and an identity associated with the malware which modified the firmware. 25 [032] In another embodiment the method includes displaying the report using the processing system. [033] In one form, repairing the firmware includes configuring the processing system to reboot and execute a bootable program prior to booting an operating system installed on 30 the processing system, wherein the bootable program is configured to enable modifications to be performed to the firmware.

C :NRPorl\bIDCC\iFS\4010424_I DOC-23II/12011 -7 [034] In another broad form there is provided a computer program product for a processing system, the computer program product including a non-transitory computer readable medium having a computer program recorded therein or thereon, the computer program product being configured to scan firmware of the processing system for malware, 5 wherein the computer program product configures the processing system to: obtain a list of firmware devices in communication with the processing system; copy the firmware for at least one firmware device stored in the processing system; and analyse the copy of the firmware for the at least one firmware device to determine 10 if the firmware has been modified by malware. [035] In another broad form there is provided a system to scan firmware of a processing system for malware, wherein the system includes: a processor; 15 memory in electronic communication with the processor; a firmware detection module configured to obtain a list of firmware devices in communication with the processing system; a copy module configured to copy the firmware for at least one firmware device stored in the processing system; and 20 the analysis module configured to analyse the copy of the firmware for the at least one firmware device to determine if the firmware has been modified by malware. [036] In another form, the system includes a storage module configured to store uncompromised firmware; and 25 a repair module configured to repair the firmware using the uncompromised firmware in the event that malware has been determined to have modified the copy of the firmware. [037] In another form, the analysis module includes a detection module, wherein the 30 detection module comprises a plurality of submodules comprising at least one of a cryptographic hash module, a checksum module, a disassembly module, and a pattern matching module.

C1NRPorIbl\DCC\HiFS\W1044_1 DOC-23/11/2011 -7A [038] In another broad form there is provided a computer readable medium of instructions to perform any of the above methods, and/or for use with any of the above systems 5 [038a] In another broad form there is provided a method wherein the report is indicative of: the copy of the modified firmware; a firmware device identity; 10 a firmware device associated with the firmware; and an identity associated with the malware which modified the firmware. [038b] In another broad form there is provided a method wherein the method includes displaying the report using the processing system. 15 Brief Description Of Figures -8 [039] An example embodiment of the present invention should become apparent from the following description, which is given by way of example only, of a preferred but non limiting embodiment, described in connection with the accompanying figures. 5 [040] Fig. I illustrates a functional block diagram of an example of a processing system that can be utilised to embody or give effect to a particular embodiment; [041] Fig. 2A illustrates a block diagram of an example system for scanning firmware of a processing system for malware; 10 [042] Fig. 2B illustrates a more detailed block diagram of the system of Figure 2A; [043] Fig. 3A illustrates a block diagram of an example system for detecting and repairing firmware of a processing system which has been compromised by malware; 15 [044] Fig. 3B illustrates a more detailed block diagram of the system of Figure 3B; [045] Fig. 4 illustrates a flow chart of an example method for scanning firmware of a processing system for malware; 20 [046] Fig. 5 illustrates a flow chart of an example method for detecting and repairing firmware of a processing system which has been compromised by malware; and [047] Fig. 6 illustrates a flow chart of an example method for scanning, detecting and 25 repairing firmware of a processing system which has been compromised by malware. Modes for Carrying Out The Invention [048] The following modes, given by way of example only, are described in order to provide a more precise understanding of the subject matter of a preferred embodiment or 30 embodiments. [049] A particular embodiment of the present invention can be realised using a processing system, an example of which is shown in Figure 1. In particular, the processing -9 system 100 generally includes at least one processor 102, or processing unit or plurality of processors, memory 104, at least one input device 106 and at least one output device 108, coupled together via a bus or group of buses 110. In certain embodiments, input device 106 and output device 108 could be the same device. An interface 112 can also be 5 provided for coupling the processing system 100 to one or more peripheral devices, for example interface 112 could be a PCI card or PC card. At least one storage device 114 which houses at least one database 116 can also be provided. The memory 104 can be any form of memory device, for example, volatile or non-volatile memory, solid state storage devices, magnetic devices, etc. The processor 102 could include more than one distinct 10 processing device, for example to handle different functions within the processing system 100. Input device 106 receives input data 118 and can include, for example, a keyboard, a pointer device such as a pen-like device or a mouse, audio receiving device for voice controlled activation such as a microphone, data receiver or antenna such as a modem or wireless data adaptor, data acquisition card, etc. Input data 118 could come from different 15 sources, for example keyboard instructions in conjunction with data received via a network. Output device 108 produces or generates output data 120 and can include, for example, a display device or monitor in which case output data 120 is visual, a printer in which case output data 120 is printed, a port for example a USB port, a peripheral component adaptor, a data transmitter or antenna such as a modem or wireless network 20 adaptor, etc. Output data 120 could be distinct and derived from different output devices, for example a visual display on a monitor in conjunction with data transmitted to a network. A user could view data output, or an interpretation of the data output, on, for example, a monitor or using a printer. The storage device 114 can be any form of data or information storage means, for example, volatile or non-volatile memory, solid state 25 storage devices, magnetic devices, etc. [050] In use, the processing system 100 is adapted to allow data or information to be stored in and/or retrieved from, via wired or wireless communication means, the at least one database 116. The interface 112 may allow wired and/or wireless communication 30 between the processing unit 102 and peripheral components that may serve a specialised purpose. The processor 102 receives instructions as input data 118 via input device 106 and can display processed results or other output to a user by utilising output device 108. More than one input device 106 and/or output device 108 can be provided. It should be - 10 appreciated that the processing system 100 may be any form of terminal, server, specialised hardware, or the like. [051] The processing system 100 may be a part of a networked communications system. 5 Processing system 100 could connect to network, for example the Internet or a WAN. Input data 118 and output data 120 could be communicated to other devices via the network. The transfer of information and/or data over the network can be achieved using wired communications means or wireless communications means. A server can facilitate the transfer of data between the network and one or more databases. A server and one or 10 more databases provide an example of an information source. [052] Referring now to Figure 2A, a block diagram is shown representing an example system 200 to scan firmware of a processing system 100 for malware. In particular, the system 200 includes a copy module 210, and an analysis module 220. 15 [053] Referring now to Figure 2B, a more detailed block diagram is shown of the system 200 of Figure 2A. In particular, the copy module includes a number of sub-modules including a firmware device detection module 213 and a data stream module 216. Also shown in Figure 2B is the analysis module which includes a number of sub-modules 20 including a cryptographic hash module 222, a checksum module 224, a pattern matching module 226, a disassembly module 228 and a reporting module 229. [054] Referring now to Figure 3A, a block diagram is shown representing an example system 300 to detect and repair firmware of a processing system 100 which has been 25 compromised by malware. In particular, the system 300 includes the copy module 210, the analysis module 220, a storage module 310, a retrieval module 320, and a repair module 330. [055] Referring now to Figure 3B, a more detailed block diagram of the system 300 is 30 shown. In particular, the copy module includes sub-modules of the firmware device detection module 213 and the data stream module 216. The analysis module includes sub modules of the cryptographic hash module 222, the checksum module 224, the pattern - 11 matching module 226, the disassembly module 228 and the reporting module 229. Also, the repair module 330 includes bootable program 333. [056] Each of these modules 210, 220, 310, 320, 330 can be implemented in software or 5 hardware. If the modules 210, 220, 310, 320, 330 are implemented in software, the modules 210, 220, 310, 320, 330 can be designed to operate on any type of processing system 100. If the modules 210, 220, 310, 320, 330 are implemented in software, the modules 210, 220, 310, 320, 330 can be designed for computer systems which operate using specific operating systems such as W[NDOWS M or Linux. Those of skill in the art 10 can easily adapt these implementations for other types of operating system or computer systems. [057] Referring first to the copy module 210, it is responsible for copying the firmware stored in firmware devices of the processing system 100. The firmware stored in the 15 processing system 100 may be compromised by malware, and therefore the copy module 210 copies the firmware for analysis. The copy module 210 can include a number of sub modules. In particular, the copy module 210 can include a firmware device detection module 213, and a data-stream module 216. 20 [058] The copy module 210 is configured to determine one or more firmware devices of the processing system 100. The copy module 210 can initiate the firmware device detection module 213 which generates a list of the one or more firmware devices of the processing system 100. The firmware device detection module 213 may call a device manager of the specific operating system used on the processing system 100 to populate 25 the list. Example firmware devices of the processing system 100 which can populate the list can include a BIOS chip, a video card, an optical storage device, a mobile phone in data communication with the processing system 100, a scanner, an MP3 player, a USB device, a digital camera, or any other device which includes EEPROM which could be susceptible to a malware attack. 30 [059] The firmware device detection module 213 of the copy module 210 is configured to determine a size of memory storage of the firmware device, and a firmware device identity for each firmware device in the list. The firmware device detection module 213 of the copy - 12 module 210 can be configured to store the size of the memory storage and firmware device identity as a record associated with each firmware device in the list. In this instance, the list may in the form of a table including records for each firmware device of the processing system 100. 5 [060] The copy module 210 can be configured to allocate an amount of memory equivalent to the size of the memory storage for each firmware device in the list. The memory allocated by the copy module 210 may be part of the RAM of the processing system 100. Alternatively, the memory allocated by the copy module 210 may be isolated 10 memory storage of the processing system 100 to reduce the likelihood of malware spreading throughout the processing system 100. [061] The copy module 210 can be configured to attempt to open a data stream with one of the firmware devices in the list. The copy module 210 can open the data stream using 15 the data stream module 216. In one form, the data stream module 216 uses a firmware device identity from the list to determine an initiation signal for the respective firmware device in order to open a data stream with the firmware device. In one form, the data stream module 216 may refer to a database which can be queried using the firmware device identity in order to determine the initiation signal for the respective firmware 20 device. In one potential form, the database may be remotely accessed using a communication network, such as the world wide web. [062] The data stream module 216 of the copy module 210 is configured to transfer the initiation signal to the firmware device in order to open a data stream with the firmware. 25 Furthermore, the data stream module 216 can be configured to determine a read signal for the particular firmware device and transfer the read signal to the firmware device, such as to request the firmware device to transfer a copy of the firmware. The data stream module of the copy module may define parameters indicating the boundaries of the memory of the firmware device which are required to be transferred. 30 [063] The data stream module 216 of the copy module can be configured to store the copy of the firmware of the respective firmware device in the allocated memory of the processing system 100.

- 13 [064] The copy module 210 can be configured to enumerate through the list of firmware devices such that copies of the firmware in each respective firmware device are copied to the allocated memory of the processing system 100. The copy module can be configured to 5 pass control to the analysis module 330 once the firmware has been copied. [065] The analysis module 220 is configured to analyse the copy of the firmware to determine if the firmware has been modified by malware. The analysis module 220 may include a number of sub-modules which can be used to perform an analysis of the copy of 10 the firmware for each firmware device of the processing system 100. In particular, the analysis module 220 can include one or more of the following sub-modules: a cryptographic hash module 222, a checksum module 224, a pattern matching module 226, and a disassembly module 228. The analysis module 220 can be configured to use one or more of these sub-modules exclusively or in combination to determine a firmware 15 signature of the copy of the firmware for a particular firmware device. [066] The analysis module 220 can be configured to compare the firmware signature to a whitelist database having firmware signatures of uncompromised firmware devices in order to determine whether the firmware of a respective firmware device is 20 uncompromised. The analysis module 220 can additionally or alternative be configured to compare the firmware signature to a blacklist database having firmware signatures of compromised firmware devices in order to determine whether the firmware of a respective device is compromised. If the analysis module 220 has been configured to use the blacklist database, the analysis module 220 can be configured to determine the malware which 25 caused the firmware to be compromised. [067] The analysis module 220 can also include a reporting module 229 which is configured to report the detection of the compromised firmware. A report may be provided to the user of the processing system 100 indicating the compromise to the firmware. 30 Additionally, or alternatively, the report may be transferred to a server, such that the server can monitor an outbreak of particular malware. In this particular instance, the analysis module, using the reporting module 229, can generate reporting data indicative of the copy of the firmware, the firmware device identity, and firmware device, and transfer the - 14 reporting data to the server. If the analysis module 220 can determine which malware has caused the firmware of the firmware device to be compromised, the analysis module 220 may also generate the reporting data, using the reporting module 229, to be indicative of an identity of the malware responsible for the firmware being compromised. 5 [068] Referring now to the sub-modules of the analysis module 220, the cryptographic hash module 222 of the analysis module 220 is configured to generate a cryptographic hash value using the copy of the firmware for the particular firmware device. As the cryptographic hash value can be used an identity, the cryptographic hash value can be used 10 in comparisons with a database to determine whether the firmware of a firmware device has been compromised. [069] The checksum module 224 of the analysis module is configured to determine a checksum for the firmware of a particular firmware device. The checksum can be 15 compared to a database (blacklist and/or whitelist) to determine whether the firmware has been modified. [070] The pattern matching module 226 of the analysis module is configured to search the copies of the firmware for particular patterns of strings or instructions which are 20 indicative of malware. The pattern matching module 226 may operate in combination with the disassembly module 228 of the analysis module 220. The disassembly module 228 is configured to disassemble the binary code stored of the firmware such that disassembly module determines processing system instructions of the firmware. The processing system instructions of the firmware can then be used by the pattern matching module 226 to 25 determine whether firmware has been compromised by malware. Although strings of instructions can be compared by the pattern matching module 226, the pattern matching module 226 may be configured to perform functional comparisons of groups of instructions to determine whether the functionality of the firmware is indicative of compromised .firmware 30 [071] The storage module 310 of the system 300 is configured to store uncompromised firmware. In one particular form, the storage module 310 is configured to store an uncompromised copy of the firmware in response to the analysis module 220 determining - 15 that a particular firmware device includes uncompromised firmware. The storage module 310 may store the uncompromised copy of the firmware in protected memory of the processing system 100. In one form the processing system may store the copy of the firmware to read only memory such as a CD-ROM. 5 [072] The retrieval module 320 of the system 300 is configured to retrieve a stored copy of uncompromised firmware which was stored by the storage module 310. The retrieval module 320 may be configured to use a firmware device identity in order to retrieve the uncompromised copy of firmware from memory of the processing system 100. 10 [073] The repair module 330 of the system 300 is configured to repair the firmware using the uncompromised firmware retrieved by the retrieval module 320. The repair module 320 can be configured to install the uncompromised firmware if provided in the form of an executable object. Alternatively, the repair module 320 may initiate the data stream 15 module 216 of the copy module 210 to open a data stream to the particular firmware device, and thus copy the uncompromised firmware over the compromised firmware of the firmware device. In one form, the repair module 330 may initiate the copy module 210 to copy only a number of blocks of uncompromised data to the firmware device to increase efficiency. 20 [074] In one particular form the repair module 330 may be provided in the form of a bootable program 333 which is initiated when the processing system 100 is booted. The bootable program 333 can be provided at particular sector of the hard drive of the processing system 100. Additionally, or alternatively, the bootable program 333 may be 25 provided as a removable input medium such as a CD-ROM, floppy disk, or USB drive. The bootable program 333 can be configured to be booted prior to the operating system of the processing system 100 booting. The bootable program 333 is configured to allow modifications to particular firmware devices such as the BIOS of the processing system 100. 30 [075] Referring now to Figure 4, there is shown a flowchart representing an example of a method 400 of scanning firmware of a processing system for malware.

- 16 [076] In particular, at step 410 the method 400 includes obtaining a copy of firmware stored in the processing system. At step 420, the method 400 includes analysing the copy of the firmware to determine if the firmware has been modified or infected by malware. 5 [077] Referring now to Figure 5, there is shown a flowchart representing an example of a method 500 of detecting and repairing firmware of a processing system which has been compromised by malware. [078] In particular, at step 510 the method 500 includes storing uncompromised 10 firmware. At step 520, the method 500 includes obtaining a copy of the firmware stored in the processing system. At step 530 the method 500 includes analysing the copy of the firmware stored in the processing system 100 to determine if the firmware has been modified or infected by malware. In the event that the firmware has been compromised by malware, the method 500 includes at step 540 retrieving the uncompromised firmware. At 15 step 550 the method includes repairing the firmware using the uncompromised firmware. [079] Referring to Figure 6, there is shown a flowchart representing a more detailed example of a method 600 of scanning firmware of the processing system 100, detecting firmware compromised by the malware, and repairing the firmware of the processing 20 system 100. [080] In particular, at step 610 the method includes obtaining a list of firmware devices for the processing system 100. This can be performed by the firmware device detection module 213 querying a device manager of the processing system 100 in order to obtain a 25 list of devices for the processing system 100. The list can be filtered by the firmware device detection module 213 in order to determine the list of firmware devices. [081] At step 620, the method includes determining a firmware device identity and memory size for each firmware device in the list. The firmware device detection module 30 213 can determine the device identity and memory size and the copy module 210 may use this data to allocate processing system 100 memory. Each allocated piece of processing system 100 memory can be associated with the firmware device identity of a respective firmware device.

- 17 [082] At step 630, the method includes opening a data stream for at least some of the firmware devices in the list. This can be performed by the data stream module 216 as indicated earlier. The data stream module 216 may determine an initiation signal which 5 can be transferred to the firmware device in order to open a data stream with the firmware device. [083] At step 640, the method includes obtaining a copy of the firmware from at least some of the firmware devices. This can be performed by the data stream module 216 10 transferring a read signal to the firmware device in order to request the firmware device to transfer a copy of the firmware for the respective device to the data stream module 216 of the copy module 210. [084] At step 650, the method includes storing the copies of the firmware in the 15 associated allocated memory. The data stream module 216 for a particular firmware device may be associated with a particular memory allocation for the respective firmware device. As such, the copy of the firmware received by the data stream module 216 is directed to the associated allocated memory. 20 [085] At step 660, the method includes analysing at least some of the copies of the firmware. In particular, the method can include initiating the analysis module 220 including one or more of the cryptographic hash module 222, the checksum module 224, the pattern matching module 226, and the disassembly module 228 to perform an analysis of at least some of the copies of the firmware. The retriever module 320 can also be used to 25 retrieve uncompromised copies of firmware from the storage module 310 which correspond to the firmware device identity, such as to allow a comparison of the uncompromised firmware with the copied firmware. Blacklist databases and whitelist databases can also be used to determine a particular type of malware that may have caused a modification to the firmware. 30 [086] Optionally at step 670, the method can include reporting compromised firmware. This can be performed by the reporting module 229 which can report the compromised firmware to the user of the processing system 100 using an output device, such as the -18 display of the processing system, and/or the reporting module 229 can report the compromised firmware to the server. [087] If the analysis module 220 has determined that at least some of the firmware has 5 been compromised with malware, the method includes at step 680 retrieving the uncompromised firmware for the compromised firmware device. The retrieval of the uncompromised firmware can be performed by the retriever module 320 using the respective device identity for the firmware. The retrieval module 320 retrieves the uncompromised firmware from the storage module 310. 10 [088] At step 690, the method includes repairing the compromised firmware using the uncompromised firmware. This can be performed by the repairer module 330 using the uncompromised firmware to repair the compromised firmware. The repairer module 330 can use the data stream module 216 to open a data stream to the compromised firmware 15 device, and then copy the uncompromised firmware to the firmware device. Optionally, one or more blocks of the uncompromised firmware may be copied to the firmware device in order to repair the firmware. [0891 For some particular forms of firmware, such as the BIOS of a processing system 20 100, the processing system 100 may need to be rebooted in order for the repairer module to repair the compromised firmware. The repairer module 216 may be provided in the form of a bootable program 333 that is loaded before the operating system of the processing system 100, in order to modify the BIOS. The repairer module may be provided on a removable medium such as a floppy disk, CD-ROM or USB drive. Alternatively, the Master Boot 25 Record may be modified to redirect the control to the repair module on a predetermined sector of the hard drive of the processing system 100. Once the repairer module 330 has been initiated, the repairer module 330 copies at least a portion of the uncompromised firmware to the compromised firmware device. 30 [090] Optionally, if data streams are still open between the data stream module 216 and the firmware devices, the data streams are closed at step 690. For particular devices, the data stream module 216 may send a close signal to the firmware device. The data stream -19 module 216 may determine the close signal similarly to determining the open signal for the particular firmware devices. [091] The method can performed by enumerating through the list of firmware devices 5 using a looping technique. This looping technique is illustrated by the following example pseudo code which can be used to implement the above described method. Function Scan(scanmode); Begin 10 Call enumerateflashable devices(list); For each device in list do Begin Size = get_flashablesize(device); 15 DeviceId = getdeviceid(device); Call Allocatememory(snapshot, size); Call Allocate memory(current, size); Call dumpflash_memory(device, current); 20 If scan-mode == NOTIFYOFCHANGES Then Begin It retrieve snapshot(DeviceId, snapshot) Then Begin If snapshot != current Then Begin User response = alertuser(DeviceId); If User response = RESPONSEOK Then Begin 25 Call savesnapshot(DeviceId, current); End Else Begin Call restoresnapshot(DeviceId, snapshot); End; End; 30 End; End; Scan result = scan memory(current); If Scan result == RESULTCLEAN Then Begin 35 Call save snapshot(DeviceId, current); End Else Begin User-response = alertuser(DeviceId); If User response = RESPONSEOK Then Begin Call savesnapshot(DeviceId, current); 40 End Else Begin Call restorefromsnapshot(DeviceId, snapshot); End; End; 45 Call Freememory(snapshot); Call Free memory(current); End; -20 End; [092] The modules and submodules described herein can be implemented as hardware, 5 software, or a combination thereof. [093] Optional embodiments of the present invention may also be said to broadly consist in the parts, elements and features referred to or indicated herein, individually or collectively, in any or all combinations of two or more of the parts, elements or features, 10 and wherein specific integers are mentioned herein which have known equivalents in the art to which the invention relates, such known equivalents are deemed to be incorporated herein as if individually set forth. [094] Although a preferred embodiment has been described in detail, it should be 15 understood that various changes, substitutions, and alterations can be made by one of ordinary skill in the art without departing from the scope of the present invention.

Claims (22)

1. A method of scanning firmware of a processing system for malware, wherein the method includes: 5 obtaining a list of firmware devices in communication with the processing system; obtaining a copy of firmware stored in the processing system for at least one firmware device in the list; and analysing the copy of the firmware for the at least one firmware device to determine if the firmware has been modified by malware. 10

2. The method according to claim 1, wherein the method includes: storing uncompromised firmware; and in the event that malware has been determined to have modified the copy of the firmware, repairing the firmware using the uncompromised firmware. 15

3. The method according to claim 1 or claim 2, wherein the step of analysing the copy of the firmware is performed using a detection module, wherein the detection module includes a plurality of submodules including at least one of a cryptographic hash module, a checksum module, a disassembly module, and a pattern matching module, wherein the 20 method includes analysing, using the plurality of submodules, the copy of the firmware to determine if the firmware has been modified by malware.

4. The method according to claim 3, wherein the method includes: generating, using the cryptographic hash module, a cryptographic hash value of the 25 copy of the firmware; and comparing the cryptographic hash value to a database to determine whether the firmware has been modified by malware, wherein the database includes a plurality of cryptographic hash values indicative of at least one of malicious entities and non-malicious entities. 30

5. The method according to claim 3 or 4, wherein the method includes: generating, using the checksum module, a checksum value of the copy of the firmware; and -22 comparing the checksum value to a list to determine whether the entity is malicious, wherein the list includes a plurality of checksum values associated with at least one or malicious entities and non-malicious entities. 5

6. The method according to any one of claims 3 to 5, wherein the method includes: disassembling, using the disassembly module, at least a portion of the copy of the firmware; and performing a comparison, using the pattern matching module, between the disassembled entity and a list of patterns associated with malicious activity. 10

7. The method according to any one of claims I to 6, wherein in the event the analysis indicates that the firmware has not been modified by malware, the method includes storing an uncompromised copy of the firmware. 15

8. The method according to claim 7, wherein in the event the analysis indicates that the firmware has been modified by malware, the method includes: retrieving the uncompromised copy of the firmware; and copying the uncompromised copy of the firmware for a firmware device containing the modified firmware. 20

9. The method according to any one of claims I to 8, wherein the method includes: iteratively analysing the firmware for each firmware device in the list.

10. A method of scanning firmware of a processing system for malware, wherein the 25 method includes: obtaining a copy of firmware stored in the processing system; and analysing the copy of the firmware to determine if the firmware has been modified by malware; wherein in the event the analysis indicates that the firmware has not been modified 30 by malware, the method comprises: storing an uncompromised copy of the firmware; retrieving the uncompromised copy of the firmware for a firmware device; and - 23 performing a comparison between the firmware of the firmware device and the retrieved uncompromised copy of the firmware to determine if the firmware has been modified by malware. 5

11. A method of scanning firmware of a processing system for malware, the method includes: obtaining a copy of firmware stored in the processing system; and analysing the copy of the firmware to determine if the firmware has been modified by malware; 10 wherein in the event that the firmware is determined to have been modified by malware, the method comprises: generating a report indicating that a firmware device includes firmware modified by malware; and transferring the report to a server processing system. 15

12. The method according to claim 11, wherein the report is indicative of: the copy of the modified firmware; a firmware device identity; a firmware device associated with the firmware; and 20 an identity associated with the malware which modified the firmware.

13. The method according to claim 11 or 12, wherein the method includes displaying the report using the processing system. 25

14. The method according to claim 2, wherein repairing the firmware includes configuring the processing system to reboot and execute a bootable program prior to booting an operating system installed on the processing system, wherein the bootable program is configured to enable modifications to be performed to the firmware. 30

15. A computer program product for a processing system, the computer program product including a non-transitory computer readable medium having a computer program recorded therein or thereon, the computer program product being configured to scan -24 firmware of the processing system for malware, wherein the computer program product configures the processing system to: obtain a list of firmware devices in communication with the processing system; copy the firmware for at least one firmware device stored in the processing system; 5 and analyse the copy of the firmware for the at least one firmware device to determine if the firmware has been modified by malware.

16. The computer program product according to claim 15, wherein the computer 10 program product configures the processing system to perform the method of any one of claims I to 14.

17. A system to scan firmware of a processing system for malware, wherein the system includes: 15 a processor; memory in electronic communication with the processor; a firmware detection module configured to obtain a list of firmware devices in communication with the processing system; a copy module configured to copy the firmware for at least one firmware device 20 stored in the processing system; and the analysis module configured to analyse the copy of the firmware for the at least one firmware device to determine if the firmware has been modified by malware.

18. The system according to claim 17, wherein the system includes a storage module 25 configured to store uncompromised firmware; and a repair module configured to repair the firmware using the uncompromised firmware in the event that malware has been determined to have modified the copy of the firmware. 30

19. The system according to claim 17, wherein the analysis module includes a detection module, wherein the detection module comprises a plurality of submodules comprising at least one of a cryptographic hash module, a checksum module, a disassembly module, and a pattern matching module. - 25

20. The system according to claim 17, wherein the system is adapted to perfonn the method of any one of claims I to 14. 5

21. A method of scanning firmware of a processing system for malware as substantially herein before described.

22. A system to scan firmware of a processing system for malware as substantially herein before described with reference to the accompanying figures. 10