Detection of secure variable alteration in a computing device equipped with unified extensible firmware interface (UEFI)-compliant firmware

A non-transitory medium holding computer-executable instructions for detecting secure variable alteration in a computing device equipped with Unified Extensible Firmware Interface (UEFI)-compliant firmware, the instructions when executed causing the computing device to:

• create with the firmware a first hash of contents of a plurality of Authenticated Variables stored in an Authenticated Variable region, the Authenticated Variable region located in a Read-Only Memory (ROM) in the computing device;
• store the first hash in an undocumented location in the computing device;
• update the first hash in response to an authorized modification of at least one of the plurality of Authenticated Variables stored in the Authenticated Variable region;
• store the updated first hash in a same or different undocumented location;
• detect, with the firmware, a subsequent boot of the computing device or an attempted access of at least one of the plurality of Authenticated Variables, the detecting occurring subsequent to the storing of the updated first hash;
• create, with the firmware, based on the detecting, a second hash of the contents of the plurality of Authenticated Variables stored in the Authenticated Variable region;
• identify with firmware an unauthorized modification of at least one of the plurality of Authenticated Variables occurring after the creation of the updated first hash by comparing the updated first hash and the second hash and detecting a difference between the updated first hash and the second hash;
• and
• perform a pre-determined remedial action based on the identification of the unauthorized modification.

A computing device equipped with Unified Extensible Firmware Interface (UEFI)-compliant firmware, comprising:

• a processor;
• and
• a Read Only Memory (ROM) holding firmware code, the firmware code when executed:
• creating a first hash of contents of a plurality of Authenticated Variables stored in an Authenticated Variable region, the Authenticated Variable region located in a Read-Only Memory (ROM) in the computing device;
• storing the first hash in an undocumented location in the computing device;
• update the first hash in response to an authorized modification of at least one of the plurality of Authenticated Variables stored in the Authenticated Variable region;
• store the updated first hash in a same or different undocumented location;
• detecting a subsequent boot of the computing device or an attempted access of at least one of the plurality of Authenticated Variables, the detecting occurring subsequent to the storing of the updated first hash;
• creating, based on the detecting, a second hash of the contents of the plurality of Authenticated Variables stored in the Authenticated Variable region;
• identifying an unauthorized modification of at least one of the plurality of Authenticated Variables occurring after the creation of the updated first hash by comparing the updated first hash and the second hash and detecting a difference between the updated first hash and the second hash;
• and
• performing a pre-determined remedial action based on the identification of the unauthorized modification.