Systems and methods for providing automatic system stop and boot-to-service OS for forensics analysis

• US 10,102,073 B2
• Filed: 05/20/2015
• Issued: 10/16/2018
• Est. Priority Date: 05/20/2015
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Swierk, Todd Erick, Andrews, Carlton A., Lo, Yuan-Chang, Seibert, Phillip M., Skipper, Chad
• Primary Examiner(s): Leibovich, Yair
• Application Number:
  US14/717,554
• Publication Number:
  US 20160342477A1
• Time in Patent Office: 1,245 Days
• Field of Search: 714 23
• CPC Class Codes: G06F 11/14 Error detection or correction of the data by redundancy in operation G06F11/16 takes precedence
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/4406 Loading of operating system

Abstract

Systems and methods for providing automatic system stop and boot-to-service OS for forensic analysis. In some embodiments, an Information Handling System (IHS) includes a processor and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to: detect an Indicator of Compromise (IoC); send, to a server, a message including the IoC; receive, from the server, a recovery instruction; and boot into a service OS identified in the recovery instruction, wherein the service OS is distinct from a main OS included in the IHS.

Claims

1. An Information Handling System (IHS), comprising:

a processor; and

a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the IHS to;

detect an Indicator of Compromise (IoC);

send, to a server, a message including the IoC;

receive, from the server, a recovery instruction, wherein the server is configured to generate the recovery instruction based, at least in part, upon the IoC and upon a recovery success history of other IHSS, and wherein the recovery instruction includes a list of two or more service OSs; and

attempt to boot at least one of the two or more service OSs in the listed order, wherein the at least one of the two or more service OSs is distinct from a main OS included in the IHS, and wherein at least one of;

(a) the recovery instruction further includes an ordered list of two or more service OS sources, wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the at least one of the two or more service OSs from at least one of the two or more service OS sources in the listed order;

(b) the recovery instruction further includes an ordered list of two or more modes of operation of the at least one of the two or more service OSs, wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the at least one of the two or more service OSs in at least one of the two or modes of operation in the listed order;

or

(c) the recovery instruction further includes a list of two or more recovery options, each recovery option having one of a plurality of service OSs, one of a plurality of service OS sources, and one of a plurality of modes of operation, wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot following at least one of the two or more recovery options in the listed order.

2. The IHS of claim 1, wherein the IoC includes a malicious artifact observed on a network, within an Operating System (OS), firmware, Unified Extensible Firmware Interface (UEFI), Basic I/O System (BIOS), or the cloud.

3. The IHS of claim 1, wherein the service OS is stored in a recovery partition of a hard drive within the IHS.

4. The IHS of claim 1, wherein the service OS is stored in a Non-Volatile Memory (NVM) or flash memory within the IHS.

5. The IHS of claim 1, wherein the service OS is stored remotely with respect to the IHS.

6. The IHS of claim 1, wherein the server is part of a Counter Threat Platform (CTP) accessible over a network.

7. A computer-implemented method, comprising:

receiving, from a client device, a message including an Indicator of Compromise (IoC);

determining, based at least in part upon the IoC and upon a recovery history of other client devices, a list of two or more service OSs; and

transmitting a recovery instruction to the client device, wherein the recovery instruction includes the list, wherein the client device is configured to boot into a service OS identified in the recovery instruction, and wherein the service OS is distinct from a main OS included in the client device.

8. The computer-implemented method of claim 7, wherein the recovery instruction includes an ordered list of two or more service OS sources, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the service OS from at least one of the two or more service OS sources in the listed order.

9. The computer-implemented method of claim 7, wherein the recovery instruction includes an ordered list of two or more modes of operation of a service OS, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the service OS in at least one of the two or modes of operation in the listed order.

10. The computer-implemented method of claim 7, wherein the recovery instruction includes a list of two or more recovery options, each recovery option having one of a plurality of service OSs, one of a plurality of service OS sources, and one of a plurality of modes of operation, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot following at least one of the two or more recovery options in the listed order.

11. A non-transitory memory device having program instructions stored thereon that, upon execution by an Information Handling System (IHS), cause the IHS to:

detect an Indicator of Compromise (IoC);

send, to a server, a message including the IoC;

receive, from the server, a recovery instruction; and

boot into a service OS identified in the recovery instruction, wherein the recovery instruction includes an ordered list of two or more service OSs, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot at least one of the two or more service OSs in the listed order.

12. The non-transitory memory device of claim 11, wherein the recovery instruction includes an ordered list of two or more service OS sources, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the service OS from at least one of the two or more service OS sources in the listed order.

13. The non-transitory memory device of claim 11, wherein the recovery instruction includes an ordered list of two or more modes of operation of a service OS, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot the service OS in at least one of the two or modes of operation in the listed order.

14. The non-transitory memory device of claim 11, wherein the recovery instruction includes a list of two or more recovery options, each recovery option having one of a plurality of service OSs, one of a plurality of service OS sources, and one of a plurality of modes of operation, and wherein the program instructions, upon execution by the processor, cause the IHS to attempt to boot following at least one of the two or more recovery options in the listed order.