Bootstrap OS protection and recovery

• US 9,288,222 B2
• Filed: 06/25/2014
• Issued: 03/15/2016
• Est. Priority Date: 02/12/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Horvath, Akos, Faieta, Alessandro
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/314,398
• Publication Number:
  US 20150082013A1
• Time in Patent Office: 629 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4406 Loading of operating system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method, system, and computer program product for protecting a computer system provides bootstrap operating system detection and recovery and provides the capability to detect malware, such as rootkits, before the operating system has been loaded and provides the capability to patch malfunctions that block the ability of the computer system to access the Internet. A method for protecting a computer system includes reading stored status information indicating whether network connectivity was available the last time an operating system of the computer system was operational, when the stored status information indicates that network connectivity was not available, obtaining a software patch, and executing and applying the software patch.

Claims

1. A method for protecting a computer system, the method comprising:

reading status information in response to a power-on self-test of the computer system, the status information indicating whether a network connectivity was available a time an operating system of the computer system was last operational;

when the status information indicates that the network connectivity was not available, obtaining a software patch;

booting the operating system of the computer system, after the obtaining; and

executing and applying the software patch, after the booting.

2. The method of claim 1, wherein the obtaining the software patch comprises:

loading a stand-alone network driver to make a connection to a device; and

downloading the software patch from the device.

3. The method of claim 1, further comprising:

determining, in response to the obtaining, an integrity of a file by scanning a Basic Input/Output System (BIOS), a bootloader, or anti-malware software, wherein the booting is performed in response to a determination that the integrity of the file is intact.

4. The method of claim 3, further comprising:

taking a corrective action, if the integrity is not intact.

5. The method of claim 4, wherein the corrective action comprises restoring a file from a network device.

6. The method of claim 3, further comprising:

determining whether a network connectivity is available, upon completion of the booting.

7. The method of claim 1, further comprising:

determining a checksum or hash of software of the computer system.

8. The method of claim 1, further comprising:

restoring the first sector of a drive of the computer system upon a detection that the first sector of the drive has been overwritten.

9. A computer system, comprising:

a processor configured to execute computer program instructions; and

a non-transitory memory configured to store computer program instructions executable by the processor to perform a method comprising

reading status information in response to a power-on self-test of the computer system, the status information indicating whether a network connectivity was available a time an operating system of the computer system was last operational;

when the status information indicates that the network connectivity was not available, obtaining a software patch;

booting the operating system of the computer system, after the obtaining; and

executing and applying the software patch, after the booting.

10. The system of claim 9, wherein the obtaining the software patch comprises:

loading a stand-alone network driver to make a connection to a device; and

downloading the software patch from the device.

11. The system of claim 9, the method further comprising:

determining, in response to the obtaining, an integrity of a file by scanning a Basic Input/Output System (BIOS), a bootloader, or anti-malware software, wherein the booting is performed in response to a determination that the integrity of the file is intact.

12. The system of claim 11, the method further comprising:

taking a corrective action, if the integrity is not intact.

13. The system of claim 12, wherein the corrective action comprises restoring a file from a network device.

14. The system of claim 11, the method further comprising:

determining whether a network connectivity is available, upon completion of the booting.

15. The system of claim 9, the method further comprising:

determining a checksum or hash of software of the computer system.

16. The system of claim 9, the method further comprising:

restoring the first sector of a drive of the computer system upon a detection that the first sector of the drive has been overwritten.

17. Computer program instructions, recorded on a non-transitory, computer readable storage medium and executable by a processor, for performing a method for protecting a computer system, the instructions comprising:

instructions to read status information in response to a power-on self-test of the computer system, the status information indicating whether a network connectivity was available a time an operating system of the computer system was last operational;

instructions to obtain a software patch, when the status information indicates that the network connectivity was not available;

instructions to boot the operating system of the computer system, after the software patch is obtained; and

instructions to execute and apply the software patch, after the operating system is booted.

18. The instructions of claim 17, wherein the instructions to obtain the software patch comprise:

instructions to load a stand-alone network driver to make a connection to a device; and

instructions to download the software patch from the device.

19. The instructions of claim 17, further comprising:

instructions to determine, in response to obtaining the software patch, an integrity of a file by scanning a Basic Input/Output System (BIOS), a bootloader, or anti-malware software, wherein the operating system is booted in response to a determination that the integrity of the file is intact.

20. The instructions of claim 19, further comprising:

instructions to take a corrective action, if the integrity is not intact.

21. The instructions of claim 20, wherein the corrective action comprises restoring a file from a network device.

22. The instructions of claim 19, further comprising:

instructions to determine whether a network connectivity is available, upon completion of booting the operating system.

23. The instructions of claim 17, further comprising:

instructions to determine a checksum or hash of software of the computer system.

24. The instructions of claim 17, further comprising:

instructions to restore the first sector of a drive of the computer system upon a detection that the first sector of the drive has been overwritten.