A Survey on the Evolution of Bootkits Attack and Defense Techniques  

作　　者：Yilin Zhou Guojun Peng Zichuan Li Side Liu 

机构地区：[1]Key Laboratory of Aerospace Information Security and Trust Computing,Ministry of Education,Wuhan 430072,China [2]School of Cyber Science and Engineering,Wuhan University,Wuhan 430072,China

出　　处：《China Communications》2024年第1期102-130,共29页中国通信（英文版）

基　　金：supported by NSFC under Grant 62172308,Grant U1626107,Grant 61972297 and Grant 62172144。

摘　　要：According to the boot process of modern computer systems,whoever boots first will gain control first.Taking advantage of this feature,a malicious code called bootkit can hijack the control before the OS bootloader and bypass security mechanisms in boot process.That makes bootkits difficult to detect or clean up thoroughly.With the improvement of security mechanisms and the emergence of UEFI,the attack and defense techniques for bootkits have constantly been evolving.We first introduce two boot modes of modern computer systems and present an attack model of bootkits by some sophistical samples.Then we discuss some classic attack techniques used by bootkits from their initial appearance to the present on two axes,including boot mode axis and attack phase axis.Next,we evaluate the race to the bottom of the system and the evolution process between bootkits and security mechanisms.At last,we present the possible future direction for bootkits in the context of continuous improvement of OS and firmware security mechanisms.

关 键 词：BOOTKIT HOOK legacy BIOS security mechanisms UEFI 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]