Development tools are growing more advanced; large language models can now write code for us based on simple plain English requests. Unfortunately, malicious actors also have access to increasingly powerful tools. As a result, cybersecurity risk management has never been more important. This mandate extends to the deepest internals of our devices, such as the firmware. Firmware vulnerabilities pose a significant threat to organizations and individuals who don’t know how to deal with them.
Firmware powers nearly every advanced hardware device on the market. The foundational software tells everything from computer motherboards to Internet of Things (IoT) devices how to function. The firmware is the bridge between hardware and software. It initializes system components and manages essential device functions. This deep access to the system makes it an attractive target for cybersecurity attackers.
Firmware vulnerabilities have existed for as long as firmware has existed. Still, it wasn’t until the Meltdown and Spectre exploits impacted nearly every computer chip in use that security researchers began to focus on them. Since then, many more hardware exploits have been found. Modern attackers use sophisticated techniques to target firmware weaknesses. Those attacks are rarely isolated. Instead, they form the foundation for larger attack chains. Some notable recent exploits include:
Meltdown and Spectre and the following exploits highlight the need to prioritize firmware security.
Although all cybersecurity threats should be taken seriously, firmware vulnerabilities can be particularly dangerous. Firmware’s unique role in the function of devices makes it a prime target for three significant reasons:
The downsides of a firmware attack are severe, but steps can be taken to reduce the chance that their software allows its users to fall victim to one. For the highest level of security, a multi-faceted approach should be adopted.
The first line of defense against firmware attacks begins during the development of the software that runs on it and can become an avenue for attack.
Static application security testing (SAST), such as Kiuwan SAST, and other application security tools during the development process can help detect potential vulnerabilities in the code. Although these tools don’t directly analyze firmware, applications interacting with firmware can be a vector for attack.
SAST and other tools work best when part of a well-thought-out DevSecOps workflow. This makes security a primary focus throughout the development process, allowing developers to find potential security problems early and remove them with minimal disruption to the software development lifecycle.
Developers who are working on firmware can better secure it by using Secure Boot and TPMs. These tools help the firmware remain resilient even if an attacker breaks through the first lines of defense.
There are also several things users themselves can do to ensure that their firmware doesn’t get compromised.
When exploits are found, firmware manufacturers patch them and send out updates. Users who don’t install those updates remain vulnerable to a public threat. Organizations should have processes to monitor firmware updates and keep all their devices securely patched.
When everything is connected, getting access to one device grants access to others. Isolating critical systems and implementing robust network segmentation can reduce the attack surface available to a potential attacker. It also limits the damage if firmware is compromised.
Firmware developers are increasingly using open-source components in their software stacks. This has both benefits and downsides from a security perspective. The good thing is that exploits are generally fixed quickly in large open-source projects. The downside is that firmware developers have code that they didn’t write in their products. This makes it essential for those developers to keep track of any open-source components they use and regularly scan for vulnerabilities in these tools. When a vulnerability is found, the firmware should be updated with the patched version of the code that removes it.
Just a decade or so ago, far fewer devices needed firmware to function. With the rise of smart devices and IoT, even your toaster may have firmware to power the screen. This means new firmware threats are continuously emerging. Some of them include:
Although firmware has always been at risk, security researchers have only recently started prioritizing it. That trend will continue as firmware takes place in more devices, as technology improves and cyber attackers become bolder. Powerful security tools are needed to thwart malicious actors and protect users from attack.
