Firmware security: why it matters
While securing other critical components of their infrastructure such as hardware and software, businesses often neglect firmware security.
Being the basic core of all its hardware stuff, an organization is fully secure when firmware can resist a malicious attack.
Threat actors may intrude in your well-defended system by the means of exploiting vulnerabilities in the poor-defended firmware of a mouse or of a webcam, for instance.
Cyberattacks against firmware are skyrocketing, putting in danger many organizations’ cyber defenses.
A recent report reads that 80 percent of enterprises have experienced at least one firmware attack in the past two years, while less than 30% of security spending goes to securing firmware.
Read more on our blog to find out why firmware security matters!
Firmware: what is it?
Often overlooked, the term firmware refers to the basic software component of a piece of hardware.
Thus, you may find firmware in any piece of hardware. The following is a list of the most common hardware parts you may bump into during the day at work or at home:
- Monitors
- USB thumb drives
- Bluetooth speakers
- Mouses
- Headphones and headsets
- Microphones and projectors
- Routers and modems
Do not forget that less sophisticated hardware such as fridges, washing machines, and remote controllers have as their sole running software a firmware itself.
This list can go on for a long. Turning back to our topic, every object listed above has a firmware as the vital core. Without it, they would not work properly.
For instance, in more complex devices such as PC and smartphones firmware is the medium between the hardware and the software components.
Firmware security
Firmware, then, is a very important component of any hardware. Are they as secure as vital?
Regrettably, no.
The following tense may well sum the level of security of firmware: it was not conceived with security in mind.
Boiling down the whole story, the security concerns around firmware is to be found in the absence of any cryptographic signature in it during the manufacturing process of hardware.
Not all hardware manufacturers neglect the cryptographic signature of firmware, but many of them do so.
This actually means that genuine firmware cannot be authenticated.
Hackers and threat actors may thus implant malicious firmware in hardware components as a result.
This leads to an obvious conclusion. Unlike malwares, malicious firmware cannot be detected.
In short, weak firmware gives attackers many attack surfaces. When attacks take place, they go on without getting noticed. Easy and plain exploitations of firmware weaknesses are behind the corner.
The worrying report mentioned in the introduction should not come as a surprise then.
Conclusion
Firmware security is a growing concern. Boosts in security make attackers focus on the weaker parts of an infrastructure. Firmware, when not well-secured, is a suitable entrance gate.
In this framework, it is likely that the spread of IoT devices will multiply attack surfaces where firmware may be exploited to get unauthorized access.
However, there is good news. Despite the general neglect of the security of this vital component companies are increasing their efforts to devote more resources to firmware security.