Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/3/2019
04:15 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

CrowdStrike Falcon Integrates Firmware Attack Detection Capability

Endpoints protected by CrowdStrike Falcon will now gain continuous monitoring for firmware attacks

Sunnyvale, CA – CrowdStrike, Inc. has announced that CrowdStrike Falcon is providing continuous monitoring that extends to the firmware level. 

Modern security tools have focused on detecting attacks at the operating system (OS) level and above, but provide little visibility into lower levels of the modern computing platform. Attackers looking to maintain stealth and persistence have targeted the BIOS to infect it with malicious code that is difficult to detect and can persist despite reboots and reinstallation of the operating system. These malicious firmware updates can be delivered via standard intrusion techniques, such as spear-phishing, or come pre-installed on a machine via attacks on the supply chain, making these threat vectors especially difficult to detect and mitigate. As supply chain attacks from nation-states and other cybercriminals persist in plaguing organizations and government agencies, continuous monitoring and enhanced detection below the OS-level is necessary for improved IT hygiene.

Today, most security products remain blind to attacks that attempt to leverage BIOS firmware to infiltrate endpoints, leaving organizations vulnerable to compromise. CrowdStrike Falcon will be the first endpoint protection platform to provide visibility into these threats, enabling organizations to thwart BIOS attacks while continuously monitoring endpoints.

Falcon collects details on BIOS images and configuration, and delivers enterprise-wide firmware visibility via the cloud-native Falcon Platform console. In addition, through an integration with Dell SafeBIOS, CrowdStrike enables enhanced detection for BIOS/firmware based threats on Dell systems. CrowdStrike Falcon improves IT hygiene through visibility over the assets, applications, and accounts being used in an organization’s environment, improving overall security posture and helping businesses take a more proactive stance to security.

“Today’s persistent nation-state actors have already begun migrating to BIOS attacks as their next preferred environment for persistence and malicious control of systems. With security researchers and companies around the world showcasing various attacks against Intel Boot Guard, Secure Boot, Intel CSME, AMD PSP and other core platform security technologies, it’s only a matter of time until such techniques become commoditized by an even wider spectrum of attackers,” said Alex Ionescu, vice president of EDR strategy at CrowdStrike. “CrowdStrike remains dedicated to providing our customers both firmware and hardware-level visibility into these vulnerabilities and attacks even before they have a chance to take off – and perhaps to even discover dormant threats that had so far been unseen.”

Furthermore, due to its strong belief in educating the community at large about these threats, CrowdStrike is planning on releasing the results of its research, as well as the unique technology it uses to capture firmware data, at future cybersecurity conferences around the world.

 For additional information on this announcement, please visit the CrowdStrike website for a blog from Alex Ionescu, vice president of EDR strategy.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13640
PUBLISHED: 2019-07-17
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
CVE-2019-5222
PUBLISHED: 2019-07-17
There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The Secure Input does not properly limit certain system privilege. An attacker tricks the user to install a malicious application and successful ...
CVE-2019-1919
PUBLISHED: 2019-07-17
A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account w...
CVE-2019-1920
PUBLISHED: 2019-07-17
A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling conditi...
CVE-2019-1923
PUBLISHED: 2019-07-17
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by access...