ConFirm: Detecting firmware modifications in embedded systems using Hardware Performance Counters

TLDR

Embedded control systems in critical infrastructure rely on microprocessor-based firmware, yet their performance constraints limit traditional security measures and software-level techniques cannot detect malicious firmware modifications. The authors propose ConFirm, a low-cost method that detects malicious firmware modifications by measuring low-level hardware events during firmware execution. ConFirm counts hardware events using existing Hardware Performance Counters on ARM and PowerPC processors to identify firmware changes. Experimental results show ConFirm detects all tested modifications with low performance overhead.

Abstract

Critical infrastructure components nowadays use microprocessor-based embedded control systems. It is often infeasible, however, to employ the same level of security measures used in general purpose computing systems, due to the stringent performance and resource constraints of embedded control systems. Furthermore, as software sits atop and relies on the firmware for proper operation, software-level techniques cannot detect malicious behavior of the firmware. In this work, we propose ConFirm, a low-cost technique to detect malicious modifications in the firmware of embedded control systems by measuring the number of low-level hardware events that occur during the execution of the firmware. In order to count these events, ConFirm leverages the Hardware Performance Counters (HPCs), which readily exist in many embedded processors. We evaluate the detection capability and performance overhead of the proposed technique on various types of firmware running on ARM- and PowerPC-based embedded processors. Experimental results demonstrate that ConFirm can detect all the tested modifications with low performance overhead.