1. A computer-implemented method for tracking attempted updates to firmware on a peripheral device of a host machine, comprising: under control of one or more computer systems configured with executable instructions, provisioning a guest operating system (OS) with non-virtualized direct memory access to at least one device of a host machine, the guest OS provisioned for a remote user and being accessible by the remote user over a network connection; configuring a secure counter to monotonically adjust a current value of the secure counter for each attempted update to firmware of the at least one device that is accessible via non-virtualized direct memory access to the guest OS; verifying at least once that the firmware has been updated by an authorized source and storing the current value of the secure counter as an expected value in a secure location inaccessible to the guest OS provisioned on the host machine; at one or more subsequent times, comparing the current value of the secure counter with the expected value; and if it is determined, based on the comparing, that the current value of the secure counter has been modified but that the authorized source had not updated the firmware, performing at least one remedial action with respect to at least one of the remote user, the firmware, the device, or the host machine.