{"id":12102,"date":"2020-02-25T10:44:42","date_gmt":"2020-02-25T15:44:42","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12102"},"modified":"2020-02-25T11:06:44","modified_gmt":"2020-02-25T16:06:44","slug":"firmware-attacks-what-they-are-how-i-can-protect-myself","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/firmware-attacks-what-they-are-how-i-can-protect-myself\/","title":{"rendered":"Firmware Attacks: What They Are &#038; How I Can Protect Myself"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Gartner\nreports that 70% of organizations lacking a firmware upgrade plan will be breached\nby 2022 due to firmware vulnerabilities<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware hacks, although they don\u2019t generally tend to share top billing with the likes of ransomware, worms and trojans, are particularly dangerous and capable of bypassing standard antivirus software by infecting the lower stack of your device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware security is certainly not as tight as it should be,\nparticularly in the basic input\/output systems (BIOSes) of most devices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A report from <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.wired.com\/2015\/03\/researchers-uncover-way-hack-bios-undermine-secure-operating-systems\/\" target=\"_blank\">Wired<\/a> shows that many BIOSes share portions of the same code. Researchers were able to detect incursion vulnerabilities in up to 80% of the PCs they examined, including those from big brands like Dell and HP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a separate study, <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.helpnetsecurity.com\/2016\/10\/20\/firmware-security\/\" target=\"_blank\">73% of participants<\/a> who didn\u2019t prioritize firmware security reported experiencing a high rate of unknown malware breaches, which made them almost impossible to track and neutralize. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, what are the biggest risks associated with firmware-related threats? And what can you do to protect yourself and your organization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What\nis Firmware?<\/h2>\n\n\n\n<figure class=\"wp-block-embed-youtube wp-block-embed is-type-video is-provider-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Firmware (Part 1): What is Firmware? | A Geek Squad 2 Minute Miracle\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/4VPMCoQgGHI?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware is the very core of your\nhardware. It\u2019s a simple software that is implanted into every piece of the\nhardware on your machine. Its primary function is to communicate with the\nsoftware installed on your computer to ensure that the hardware is able to\nexecute commands correctly. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certain kinds of firmware are usually\nonly compatible with the make and model of the computer it\u2019s installed on. This\nmeans it can usually be rewritten or uninstalled altogether. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware updates will usually be rolled\nout by hardware companies to fix problems, deliver security patches and add new\nfeatures to the device.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Understanding the Threat<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware vulnerabilities give malicious\nactors access to your systems \u2014 often without you knowing it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s because firmware hacking compromises\na device before it has even booted up. It does this by pushing malicious\nsoftware into the code on the lower levels, which regulates the hardware prior to\nand after system initialization. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once the rogue code has found its way\ninto the system, it has the ability to: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>modify and sabotage the firmware, <\/li><li>target sections of the OS, <\/li><li>infiltrate software, and <\/li><li>a lot more. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Simple BIOS and newer UEFI systems are\nfrequent points of attack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hacks to the firmware can come in multiple forms; malware, bootkits and <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-a-rootkit-and-how-does-it-work\/\">rootkits<\/a> are all popular delivery vectors. <a href=\"https:\/\/www.thesslstore.com\/blog\/usb-flash-drive-malware-how-it-works-how-to-protect-against-it\/\">Infected USBs<\/a>, corrupted drives and bad firmware products, are also something to be aware of. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A hacker does not need to come into physical contact with a device to deliver the code \u2014 this can be done remotely through Wi-Fi, Bluetooth and any other kind of network connectivity. And now that we can connect our phones, <a href=\"https:\/\/www.wired.com\/2017\/03\/worried-cia-hacked-samsung-tv-heres-tell\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">televisions<\/a>, game consoles and the like to the internet, there\u2019s an increasingly possibility of an attack. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Firmware Vulnerabilities Affects Everything, Including the\nAutomotive Industry<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The auto industry is also an area of interest for hackers, with\nthe rise of autonomous vehicles.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These days, virtually all modern vehicles include Wi-fi and Bluetooth. And as vehicles become more technologically advanced, they\u2019ll become almost IoT devices in their own right. This means that both security and operational updates will be delivered <a href=\"https:\/\/www.youtube.com\/watch?v=M6UOllIJyzk\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">over the air<\/a> (OTA), which makes perfect sense for both the manufacturer and the owner. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, this technology has attracted the interest of hackers. We can expect to see them piggyback on the OTA software to install malicious code that can control some aspect of the vehicle\u2019s operation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In 2018, a similar such incident occurred when it was discovered that a Russian cyberespionage group had compromised the <a href=\"https:\/\/www.welivesecurity.com\/2018\/09\/27\/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">LoJack anti-vehicle theft system<\/a>. The altered software was able to inject a trojan into the startup routine of the vehicle.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once in place, the module was able to mirror legitimate firmware, which allowed it to mine data, \u201cbrick\u201d around the system and provide unauthorized access. It was also able to stay put even after hard drive replacements and OS reinstallations. <\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12653\"><\/span>\n\n\n\n<h2 class=\"wp-block-heading\">Firmware Security: Why It\u2019s Important<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A firmware hack becomes exponentially worse when you consider that electronics are packed full of firmware \u2014 from webcams and sound cards to even the batteries. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware malware exploits this widespread usage. Since firmware isn\u2019t secured by <a rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\" href=\"https:\/\/www.tutorialspoint.com\/cryptography\/cryptography_digital_signatures.htm\" target=\"_blank\">cryptographic signature<\/a>, it can\u2019t detect an infiltration, which means that it can take many months for your IT security team to figure out that anything is amiss. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These attacks can be treacherous because they can be so hard to detect. Once they&#8217;re embedded within the code, they can cause ongoing harm, infect legitimate firmware updates and can even stick around after OS reinstallation or even complete hard drive wipes!&nbsp;&nbsp; <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Biggest Firmware Threats Facing Your\nOrganization?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Lapses in firmware security open you up to the same risks you\u2019re exposed to if you aren\u2019t protecting your devices from <a href=\"https:\/\/www.thesslstore.com\/blog\/10-types-of-phishing-attacks-and-phishing-scams\/\">phishing<\/a>, or email hacks, such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Spying on your activity<\/li><li>Mining your data<\/li><li>Remotely controlling your device<\/li><li>Stealing your identity <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">What makes firmware such an easy target\nis the fact that it\u2019s easy to corrupt, which presents low-hanging fruit for\nhackers of all skill levels. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of what a hacker may do once they penetrate your device, you need to be aware of how to stop the attack from occurring in the first place.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Implement Firmware Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before we offer up any tips about firmware security, it\u2019s pretty crucial to bear in mind that securing firmware is primarily in the hands of those who design the hardware.&nbsp; The outlook at this point indicates there is still much work to do be done, given that the cost of data breaches is expected to reach <a href=\"https:\/\/cybersecurityventures.com\/hackerpocalypse-original-cybercrime-report-2016\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">$6 trillion in 2021<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many new firmware susceptibilities are continually\nbeing found on every electronic device from PCs to printers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Of course, the flip side of this is that these discoveries are forcing the hand of the hardware manufacturers to develop stronger firmware security measures. Some manufacturers are releasing updates, patches and stronger security measures to try to combat firmware security breaches. This solutions include Intel\u2019s <a href=\"https:\/\/www.intel.com\/content\/www\/us\/en\/architecture-and-technology\/hardware-shield.html\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Hardware Shield<\/a>,&nbsp; <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2019\/10\/21\/microsoft-and-partners-design-new-device-security-requirements-to-protect-against-targeted-firmware-attacks\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Microsoft\u2019s OS protection<\/a> and <a href=\"https:\/\/blog.dellemc.com\/en-us\/bios-verification-protects-pc-firmware-against-threats\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">Dell\u2019s Enhanced BIOS Verification<\/a>, all of which are designed to combat long-overlooked vulnerabilities in this area. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Update Your Firmware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As we\u2019ve already explored, many\nmanufacturers are releasing updates based on newly discovered vulnerabilities.\nThis helps to ensure that firmware is working as it should while also allowing\nmanufacturers to add new features to the device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You need to make it a habit of looking\nfor updates and updating your firmware to the latest versions as quickly and as\noften as you can to close off lax security avenues and keep your hardware\nrunning smoothly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Don\u2019t Use Untrustworthy USBs<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb-1024x640.jpg\" alt=\"Graphic: a USB that represents using trustworthy USB devices only to avoid firmware vulnerabilities and malware.\" class=\"wp-image-12105\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb-1024x640.jpg 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb-300x188.jpg 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb-768x480.jpg 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb-1536x960.jpg 1536w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/firmware-security-avoid-badusb.jpg 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.thesslstore.com\/blog\/usb-flash-drive-malware-how-it-works-how-to-protect-against-it\/\">USB safety<\/a> is a topic I\u2019ve covered extensively.\nWhile they\u2019re very convenient devices, in the wrong hands, they can be ticking\ntime-bombs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A hacker can store malware on the firmware of the device \u2014 take the example of <a href=\"https:\/\/www.wired.com\/2014\/10\/code-published-for-unfixable-usb-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">BadUSB<\/a>, the name given to malware which can worm into the firmware of almost any USB device. As soon as the USB is plugged in, the malware works its way into your computer. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">BadUSB is hard to detect and even harder\nto remove, and there is no available quick fix to protect against it. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The only real protection is to use a USB\nthat belongs to you and is used exclusively by you.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Purchase Built-in Firmware Protected Hardware<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The best thing you can do, as a\nconsumer, is purchase hardware that includes advanced firmware security. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">BIOS vendors, along with other hardware\ncompanies, are catching up with their security protocols in light of increasing\nfirmware vulnerabilities. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Take the Dell Enhanced BIOS verification, that we mentioned earlier as an example. It works by assessing the BIOS image against the official \u201c<a href=\"https:\/\/encyclopedia2.thefreedictionary.com\/Hash+(computer+science)\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">hash<\/a>\u201d on the Dell server. If something is amiss, it will immediately alert the user. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Where Does the Future Hold for Firmware Security?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The next step for firmware security\nfalls to the firmware researchers, developers and hardware companies. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As new weaknesses are exposed, new\npatches and updates will need to be produced. For your part you should ensure\nthat you\u2019re: <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>purchasing electronics with added layers of firmware security; <\/li><li>updating current machines as much as possible; and, as always <\/li><li>not plugging in USB devices that you can\u2019t identify. <\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As with most things in life, it\u2019s\nimportant to keep ahead of the curve \u2014 and cybersecurity is certainly worth the\ntime and effort to stay on top of.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Firmware attacks receive much less\nattention than other large-scale cyber threats. But make no mistake \u2014 they\u2019re\njust as capable of causing huge upheaval for those who are impacted. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gartner reports that 70% of organizations lacking a firmware upgrade plan will be breached by 2022 due to firmware vulnerabilities Firmware hacks, although they don\u2019t generally tend to share top&#8230;<\/p>\n","protected":false},"author":26,"featured_media":12103,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[11881],"class_list":["post-12102","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-firmware","post-with-tags"],"views":29684,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/02\/security-needed-for-firmware.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=12102"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12102\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/12103"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=12102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=12102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=12102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}