Countermeasures to Covert Access Methods to Reduce Attack Susceptibility and Ensure Trust

The majority of existing computer security products and software development efforts have assumed that the OS kernel, firmware, and low-level subsystems of the underlying computer architecture are trusted entities. However, recent demonstrations of novel and sophisticated attacks on several fundamental components found in standard laptops, desktops, and servers have emphasized that the foundations of trust upon which critical systems are built must be thoroughly re-examined. Pikewerks proposes to address deep-level vulnerabilities within computer systems through the development of a novel proactive monitoring approach for detecting and preventing even the most sophisticated covert access methods from achieving successful exploitation. Our approach seeks to prevent attacks by malicious insiders, intelligence operatives, or other sophisticated saboteurs that subvert core processing capabilities of a computer system by attacking low-level components such as maintenance processor modes (SMM), BIOS modules, hardware-assisted hypervisors, and peripheral firmware. The result of this Phase I effort will be a security design and proof-of-concept implementation that reduces a system’s susceptibility to low-level exploits while also providing high assurance that the fundamental components and devices of the computer system are operating in a trustworthy manner.