With recent developments in PC security, more and more protection is being built directly into the operating systems. As a result, attackers have started looking for other areas of exploitation, with firmware emerging as a prime target.
According to the National Institute of Standards and Technology’s (NIST) National Vulnerability Database, the number of firmware vulnerabilities has increased by five times over the past 3 years.
In order to control the situation, Microsoft has announced a new initiative called ‘Secured-core PCs’. The company is working on a solution in collaboration with Intel, AMD, and Qualcomm.
Since firmware is developed by hardware manufacturers rather than OS manufacturers, there are multiple varieties of firmware and every one of them has its own set of vulnerabilities. Microsoft says,
Attacks targeting firmware can undermine mechanisms like secure boot and other security functionality implemented by the hypervisor or operating system making it more difficult to identify when a system or user has been compromised.
Microsoft’s Objectives
The company is aiming to create devices that meet a set of specific requirements. These requirements will include minimum trust in the device core or firmware layer and practices of isolation.
By working on this solution, Microsoft expects to help industries like financial services, government, and healthcare along with workers that deal with personal customer data and highly-sensitive IPs.
Secured-Core PC
According to Microsoft,
Secured-core PCs combine identity, virtualization, operating system, hardware, and firmware protection to add another layer of security underneath the operating system. Unlike software-only security solutions, Secured-core PCs are designed to prevent these kinds of attacks rather than simply detecting them. Our investments in Windows Defender System Guard and Secured-core PC devices are designed to provide the rich ecosystem of Windows 10 devices with uniform assurances around the integrity of the launched operating system and verifiable measurements of the operating system launch to help mitigate against threats taking aim at the firmware layer.
The requirements mentioned by Microsoft will allow the system to boot securely by protecting the device from vulnerabilities in the firmware. It will also help shield the OS in case of an attack and prevent unauthorized access to data.
Removing Hardware Trust From Firmware
With this new system, Microsoft wants to remove or at least limit hardware’s trust in the firmware. The company says that processors will be built with Dynamic Root of Trust for Measurement (DRTM) capabilities which will allow the system to boot with firmware but then re-initialize into a trusted and secure state with the help of Microsoft’s boot loader.
According to Microsoft, the process will have the capability, “to send the system down a well-known and verifiable code path.”
With Windows 8, the company launched a secure boot system to remove any risk of malicious bootloaders and rootkits based on the Unified Extensible Firmware Interface (UEFI) firmware. Where this helps prevent specific attacks, it does not prevent the threats that come from vulnerabilities in the trusted firmware.
Microsoft is currently working on Secured Core PCs and it is expected that the upcoming Surface Pro X will be one of the first devices to feature this system.
So, now we all have to buy a new computer that still runs Windows 10 but there is supposed to be a new system CPU that protects us. How long will that last until the next new attack comes about.