CHIPSEC gets new UEFI Whitelist command

I've added blacklisting module in chipsec long before, whitelisting module was logical next step in the works, so not just now

— Yuriy Bulygin (@c7zero) March 12, 2017

Added module to generate a white-list of firmware execs and check it against BIOS image to @chipsec run:chipsec_main -m tools.uefi.whitelist

— Alex Bazhaniuk (@ABazhaniuk) March 9, 2017

DerStarke/Darkmatter EFI firmware implant injects/patches PEI/DXE binaries in the firmware. With tools.uefi.whitelist you can find the mods

— Yuriy Bulygin (@c7zero) March 9, 2017

this is how it would look like on the original "clean" firmware image without rootkit's mods. 276 executables instead of 279 pic.twitter.com/DWDFV7bPEM

— Yuriy Bulygin (@c7zero) March 9, 2017

Run chipsec_main -m tools.uefi.whitelist on a clean system. It extracts firmware from flash & creates baseline list of EFI executables in it

— CHIPSEC (@CHIPSEC) March 9, 2017

Below example is detecting modifications to UEFI firmware done by HackingTeam's UEFI rootkit. original.json was generated from clean image pic.twitter.com/mBJXYanvLN

— Yuriy Bulygin (@c7zero) March 9, 2017

New module added to generate & check the "whitelist" of EFI executables: chipsec_main -m tools.uefi.whitelist https://t.co/OBagBMtyL4

— CHIPSEC (@CHIPSEC) March 9, 2017