Microsoft Extends its ATP Defender Protection to UEFI BIOS With UEFI Scanner

[Raevenlord]

Microsoft has announced an extension to the Windows Defender System Guard which will allow it to also verify and guarantee integryity of systems at a UEFI BIOS level. Citing an increase in hardware and firmware-level attacks over the years, the extended protection functionality aims to guarantee protection across the entire hierarchy of a device, from firmware up through to cloud processing.

The UEFI scanner is a new component of the built-in antivirus solution on Windows 10 and gives Microsoft Defender ATP the unique ability to scan inside of the firmware filesystem and perform security assessment. Working in conjunction with your systems' chipset, the UEFI scanner features a three-pronged solution to firmware security: UEFI anti-rootkit, which reaches the firmware through Serial Peripheral Interface (SPI); Full filesystem scanner, which analyzes content inside the firmware; and a Detection engine, which identifies exploits and malicious behaviors.





This new tool aims to increase odds of detection for devices whose boot has already been compromised by rootkits or other kind of malware acting at the firmware level. The idea is to keep your boot flow secure and trustworthy, something that will almost certainly be rendered impossible by a rootkit messing with OS and software protection privileges to keep escalating their control over your machine.



View at TechPowerUp Main Site

 

[stimpy88]

And how do we get this?

A specific version of Windows 10?

An automatic update for all versions of Windows 10?

A separate download?

And when do we get this?

 

[T3RM1N4L D0GM4]

Actually, you need Microsoft 365 A5 subscription to enable ATP capabilities and the Microsoft Defender Security Center portal...

 

[Caring1]

Sure, we'll just give Microsoft full access and control over our systems right down to Bios level.

 

[_Flare]

Start free trial

Microsoft Defender for Endpoint | Microsoft Security

Microsoft Defender for Endpoint helps stop attacks, scales endpoint security resources, and evolves defenses. Learn more about cloud-powered endpoint protection.

www.microsoft.com

 

[laszlo]

just wonder how the scanner can recognize a hacked signed firmware ...

 

[er557]

i hope it does not detect OC tweaks such as xeon turbo uefi hack, which loads via efi command each boot

 

[Solaris17]

And how do we get this?

A specific version of Windows 10?

An automatic update for all versions of Windows 10?

A separate download?

And when do we get this?

This is enterprise stuff. You might be able to get past the business requirements but you will pay out the nose for licensing.

 

[Cheeseball]

Hey this actually works with Intune within Azure too. You can monitor company laptops now.

 

[Solaris17]

Hey this actually works with Intune within Azure too. You can monitor company laptops now.

yes was actually happy to see the panel isn’t terrible either. If we weren’t getting such a deep discount on our current offering I’d be tempted to switch to be honest.

 

[Ashtr1x]

Microshaft can now scan our BIOS firmware ? and we want to keep that garbage ? lol. Nope Win10 is already a piece of crap with bugs always thrown into the wild and release a crappy patch tuesday while enterprise users get a polished and stable options with all customized WaaS garbage - Windows as a Service. M$ is just absuing their monopoly nowadays, made Office as a Service, OS as a service and their game studios is literal trash tier garbage, ruined Gears of War with some political garbage shoe horned for representation and massive departure of art style and still no release on PC, their Halo MCC is full of bugs and garbage issues. No hope for this but they will always have thier stock at top because of monopoly and successful subversion of people thinking M$ does for their best.

 

[mcraygsx]

Sure, we'll just give Microsoft full access and control over our systems right down to Bios level.

Very well said and Microsoft has deep roots that are connected to foreign government aka India.

 

[Gmr_Chick]

How come every Microsoft article on here devolves into the usual "Microsoft sucks!" crap?

 

[zlobby]

Because screw users paying $400 for genuine retail Win 10 Pro licenses, or God forbid - Pro for Workstations...
3 words - fek you M$

 

[Cheeseball]

yes was actually happy to see the panel isn’t terrible either. If we weren’t getting such a deep discount on our current offering I’d be tempted to switch to be honest.

Didn't Microsoft offer your company that "hefty" discount at the beginning of COVID? Our renewal was in February but they extended a bit and hit us with an offer we cannot refuse. Way better than the trash GSuite that Google was attempting to deal to us. We have an internal Outlook add-in (or add-on according to Google) that we need to integrate for all faculty and staff members and they said its not possible to convert because they want us to conform to their "Build cards" thing. Our CIO obviously said no.

 

[lexluthermiester]

Actually, you need Microsoft 365 A5 subscription to enable ATP capabilities and the Microsoft Defender Security Center portal...

So not a lot of people are going to have to get it.

 

[GoldenX]

Great, UEFI level botnet.

 

[R-T-B]

Great, UEFI level botnet.

We've had those for a while.

I doubt this'll work without firmware integration anyways. It certainly won't be able to REMOVE any threats without help from the firmware vendor, so kinda pointless.

I sort of was one of the UEFI malware pioneers, if people recall. Dealt with a case a year or so ago. I know a thing or two and this is really just publicity horseshit.

just wonder how the scanner can recognize a hacked signed firmware ...

it's most likely just running signature checks and then saying "oh nos!" and leaving you to figure it out...

 

[GoldenX]

We've had those for a while.

I doubt this'll work without firmware integration anyways. It certainly won't be able to REMOVE any threats without help from the firmware vendor, so kinda pointless.

I sort of was one of the UEFI malware pioneers, if people recall. Dealt with a case a year or so ago. I know a thing or two and this is really just publicity horseshit.



it's most likely just running signature checks and then saying "oh nos!" and leaving you to figure it out...

So basically, as useful as Windows Firewall.

 

[Flanker]

How come every Microsoft article on here devolves into the usual "Microsoft sucks!" crap?

More like how every article here devolves into the usual "[Company/Organisation/Country] sucks!" crap

 

[R-T-B]

More like how every article here devolves into the usual "[Company/Organisation/Country] sucks!" crap

Microsoft sucking is practically an internet meme at this point though.

Not always a justified one but certainly a hard to defeat one.

 

[lexluthermiester]

I doubt this'll work without firmware integration anyways. It certainly won't be able to REMOVE any threats without help from the firmware vendor, so kinda pointless.

Pretty much this, yes.

More like how every article here devolves into the usual "[Company/Organisation/Country] sucks!" crap

That happens everywhere. TPU is not the exclusive hotbed of complainers. Have you ever been on Reddit? 'Cause damn...

 

[Easo]

How come every Microsoft article on here devolves into the usual "Microsoft sucks!" crap?

Not sure, but it always draws the tinfoil out, like this one below:

Microshaft can now scan our BIOS firmware ? and we want to keep that garbage ? lol. Nope Win10 is already a piece of crap with bugs always thrown into the wild and release a crappy patch tuesday while enterprise users get a polished and stable options with all customized WaaS garbage - Windows as a Service. M$ is just absuing their monopoly nowadays, made Office as a Service, OS as a service and their game studios is literal trash tier garbage, ruined Gears of War with some political garbage shoe horned for representation and massive departure of art style and still no release on PC, their Halo MCC is full of bugs and garbage issues. No hope for this but they will always have thier stock at top because of monopoly and successful subversion of people thinking M$ does for their best.

I could try to argue, but what is the point?

 

[R-T-B]

If anyone wanted to actually formulate an argument, they could talk about how the UEFI spec is kinda bloated and sucks in that way... but then they'd really have to blame one of the sponsor companies (Intel is one IIRC) not Microsoft.

That happens everywhere. TPU is not the exclusive hotbed of complainers.

For certain.

 

[zlobby]

And how AGESA and the rest are proprietary blobs. I mean yeah, 'trade secrets' but we can never be sure.