VirusTotal can now also check firmware images for malware

Google’s online virus scanner VirusTotal can now also check firmware images for malware. With this, the company is responding to the fact that there are more and more firmware infections that are difficult to detect and remove.

The service can perform a number of functions, including reading and checking certificates from firmware images and executable files. It is also possible to analyze the separate UEFI executable files from the submitted images, with which to check whether an infection is present. VirusTotal also allows users to view tabs containing file details and additional information.

According to the company, the new feature is necessary, as firmware malware would no longer be deployed solely by the NSA. It refers to the bios rootkit, which Lenovo built into certain laptop models, and Hacking Team’s uefi rootkit. VirusTotal’s post also offers users some tips on how to dump the bios into a file that can be uploaded to the service.

Malware embedded in device firmware is difficult to detect and remove. For example, the bios loads into memory before starting the operating system and remains intact even when a system is reinstalled. Also, according to VirusTotal, most anti-malware products do not scan at the bio-level, making detection difficult. VirusTotal was purchased by Google in 2012 and uses 55 antivirus products and 61 scanning engines to scan.