Menu
Google's VirusTotal now picks out suspicious firmware

Google's VirusTotal now picks out suspicious firmware

The new tool provides technical details about firmware images, a target for attackers

Google's VirusTotal service has added a new tool that analyzes firmware, the low-level code that bridges a computer's hardware and operating system at startup.

Advanced attackers, including the U.S. National Security Agency, have targeted firmware as a place to embed malware since it's a great place to hide. 

Since antivirus programs "are not scanning this layer, the compromise can fly under the radar," wrote Francisco Santos, an IT security engineer with VirusTotal, in a blog post on Wednesday.

Also, malware hidden in firmware often can't be easily erased and can survive reboots and fresh installs of an OS, Santos wrote.

VirusTotal's scanning service allows researchers and analysts to upload malware.  The service indicates if antivirus products detect a sample of malware and other technical information.

The new tool will label firmware images as either legitimate or suspicious. It can also extract certificates attached to firmware and if there are other executable files inside of it.

Santos wrote that the tool can extract portable executables (PEs) inside firmware since these could sometimes be a source of malicious behavior.

"These executables are extracted and submitted individually to VirusTotal, such that the user can eventually see a report for each one of them and perhaps get a notion of whether there is something fishy in their BIOS image," Santos wrote.

Some portable executables will run on Windows rather than within the firmware. It could be a sign of bad behavior, but on occasion it is legitimate. Santos linked to an example in which a PE prove to be an antitheft feature designed to stay in place even if a computer was wiped.

It will now be possible for people to extract their own firmware and submit it to VirusTotal, which has the potential to create a database of various firmware images that could contribute to research into bad ones.

Santos included tips for extracting a firmware image without revealing sensitive information that may be contained in the code.

 


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments