Dell Releases A New Cybersecurity Utility To Detect BIOS Attacks

Dubbed ‘SafeBIOS Events & Indicators of Attack‘ (IoA),
the new endpoint security software is a behavior-based threat
detection system that alerts users when BIOS settings of their
computers undergo some unusual changes.

BIOS (Basic Input Output System) is a small but highly-privileged
program that handles critical operations and starts your computer
before handing it over to your operating system.

Protecting the BIOS program is crucial because:

• Changes to the system BIOS settings could allow malicious
  software to run during the boot process,
• Once a hacker takes over the BIOS, he can stealthily control
  the targeted computer and gain access to the data stored on
  it,
• Malware in BIOS remains persistent and doesn’t get away even
  when you format or erase your entire hard drive,
• Attacks against the BIOS are typically hard to detect because
  they are invisible to antivirus and other security software
  installed on the system,
• With stealth access to one of the compromised systems in
  an enterprise IT network, sophisticated attackers could move
  laterally throughout the infrastructure.

According to Dell, the controls offered by SafeBIOS can quickly
mitigate the risk of BIOS tampering by bringing them to your
attention timely, allowing you to quarantine infected PCs.

“Organizations need the ability to detect when a malicious actor
is on the move, altering BIOS configurations on endpoints as part
of a larger attack strategy. SafeBIOS now provides the unique
ability to generate Indicators of Attack on BIOS configurations,
including changes and events that can signal an exploit,” David
Konetski, VP Client Solutions Group CTO at Dell said in a blog post.
^[1]

“When BIOS configuration changes are detected that indicate a
potential attack, security and IT teams are quickly alerted in
their management consoles, allowing for swift isolation and
remediation. SafeBIOS Events & IoA provides IT teams the visibility
into BIOS configuration changes and analyzes these for potential
threats – even during an ongoing attack.”

The company says the SafeBIOS Events and Indicators of Attack
tool is currently available for Dell commercial PCs through its
Dell Trusted Devices solution.