Windows Defender implements a feature to prevent attacks on chipset UEFI firmware

Computer security in recent years has improved a lot and has focused on other aspects, beyond software. Microsoft has even managed to get Windows Defender listed as one of the best antivirus available. After the Windows 10 2004 update, the antivirus Windows Defender adds a UEFI firmware scanner that allows detecting possible attacks to the firmware, adding more layers of security.

Windows Defender is the best antivirus possible for Windows 10 and does not require paying additional licenses. This one has real-time, heuristic, and behavior-based protection, which is great. Integrating a UEFI scanner solution is a cool add-on that was much needed as these attacks are on the rise.

Windows Defender adds scanner for UEFI firmware

This new UEFI scanner scans firmware files when running interacting with the motherboard chipset. It has the ability to analyze and detect the following security threats:

• UEFI anti-rootkit that scans the firmware via the serial peripheral interface
• Full file system scanner that analyzes content within firmware
• Detection engine that identifies exploits and malicious behavior

The firmware scan is orchestrated by runtime events such as suspicious driver loading and through periodic system scans. Detections are reported in Windows Security, in the Protection History.

The Unified Extensible Firmware Interface (UEFI) is a replacement for the legacy BIOS. If the chipset is configured correctly (UEFI and the chipset's own configuration) and Secure Boot is enabled, the firmware is reasonably secure. To perform a hardware-based attack, attackers exploit vulnerable firmware or a misconfigured machine to implement a rootkit, allowing the attackers to gain support on the machine.

The new UEFI scanner adds to a broad set of Microsoft technologies that are integrated to deliver chip-to-cloud security, from a strong hardware root of trust to cloud-powered security solutions at the operating system level.