Comproming the software that controls the hardware itself
Introduction
When we think about cyber attacks, we usually think about attacks against applications, operating systems, networks or user accounts. However, beneath the operating system is another important layer of software that is often overlooked:
Firmware.
Firmware is the software stored on a device that provides low-level instructions allowing the hardware to interact with the operating system and as such, be able to function.
It can be found in almost every modern computing device, including:
- Computers
- Servers
- Routers
- Network switches
- Printers
- Smartphones
- IoT devices
- Industrial control systems
- Storage devices
- Security appliances
Because firmware operates at such a fundamental level, compromising it can give an attacker a particularly powerful position.
A compromised operating system can potentially be reinstalled – But a compromised firmware layer can be much harder to detect, remove and recover from.
What is firmware?
Firmware is specialised software that provides instructions directly to hardware. It sits between the physical hardware and higher-level software such as the operating system.
When a computer starts, firmware performs the important tasks such as initialising the hardware and preparing the system for the operating system to load.
On a modern PC, firmware is commonly provided through the Unified Extensible Firmware Interface (UEFI), which is the code that comes with the chipset on the motherboard of the device – This replaced the earlier Basic Input/Output System (BIOS)
Other devices may use their own specialised firmware.
Because firmware controls such fundamental operations, compromising it can provide an attacker with access below the normal operating-system security controls.
What are firmware attacks?
A firmware attack occurs when an attacker exploits, modifies or replaces firmware in order to compromise a device.
The attack could involve:
- Exploiting a firmware vulnerability
- Installing malicious firmware
- Modifying legitimate firmware
- Compromising firmware update mechanisms
- Exploiting poorly protected firmware interfaces
- Downgrading firmware to a vulnerable version
- Manipulating firmware configuration
- Compromising a device during manufacturing or distribution
The objective is often to establish persistent control over the device.
Why is firmware such an attractive target?
Because firmware sits beneath the operating system, it creates an important security advantage for an attacker. Security software running inside Windows or Linux may be able to detect malicious processes, files and network connections, but malicious code operating at a lower level may be much harder for the operating system to observe.
And even harder to remove!
If the attacker compromises the firmware layer, they may be operating underneath many of the security controls normally used to protect the operating system.
This is one reason firmware attacks can be particularly serious.
How firmware attacks work
There are several different ways attackers can compromise firmware.
Exploiting firmware vulnerabilities
Firmware is just software, and like other software it can contain vulnerabilities.
A vulnerability in firmware may allow an attacker to:
- Execute code
- Modify configuration
- Bypass security controls
- Access sensitive information
- Disable security mechanisms
- Install persistent malicious code
Firmware vulnerabilities can be particularly dangerous because they may affect the device before the operating system has even started.
Malicious firmware updates
Firmware is regularly updated by manufacturers to fix bugs, improve functionality and address security vulnerabilities – The firmware update process therefore becomes an attractive target.
If an attacker can compromise the update mechanism, they may be able to distribute malicious firmware to legitimate devices.
An attacker attempting to compromise the process might instead introduce the compromised update and overwrite the legitimate firmware code with their own code
The device may appear to have received a legitimate update while actually installing attacker-controlled code.
Firmware persistence
One of the most significant characteristics of firmware attacks is persistence.
If an attacker compromises a Windows computer and installs malware, this will often be identified by the many security controls in place for these exact things.
The organisation may detect the malware and respond by:
- Removing the malware
- Reinstalling Windows
- Restoring the system
- Replacing the hard drive
However, if malicious code has been implanted into firmware, simply reinstalling the operating system may not remove the attackers ability to still control the device.
The malicious firmware may remain underneath the newly installed operating system.
This can allow the attacker to potentially regain access after remediation.
UEFI Attacks
As mentioned above, modern PCs commonly use UEFI rather than the older BIOS system.
UEFI is responsible for initialising hardware and starting the operating-system boot process.
Because UEFI executes before the operating system, compromising it can provide an attacker with an extremely powerful position.
If the firmware itself has been compromised, malicious code may execute before traditional operating-system security mechanisms are fully operational.
Bootkits
A bootkit is malware designed to compromise the boot process. Rather than simply installing malware inside Windows, a bootkit attempts to gain control during the system’s boot sequence.
Because the malicious component executes so early in the boot process, it can potentially interfere with security mechanisms and maintain persistence across operating-system reinstalls.
Firmware implants
A firmware implant is malicious code deliberately placed inside firmware.
An attacker may use an implant to:
- Maintain persistence
- Monitor system activity
- Modify system behaviour
- Disable security mechanisms
- Provide covert access
- Load additional malware
The attacker does not necessarily need to modify the entire firmware image. Even a small modification can potentially provide a mechanism for executing additional malicious code.
Router and network device firmware
Firmware attacks are not limited to computers. Network equipment is an important target because routers, switches and security appliances often sit at critical points within an organisation’s infrastructure.
A compromised router could potentially allow an attacker to:
- Intercept network traffic
- Modify DNS responses
- Redirect users
- Monitor communications
- Modify configuration
- Establish persistent access
- Attack other devices on the network
This makes firmware security particularly important for network infrastructure.
IoT firmware attacks
Another major firmware security concern it that which surrounds Internet of Things (IoT) devices
Due to the small form-factor of many IoT devices, many run relatively small operating systems with limited security controls.
Examples include:
- Smart cameras
- Smart televisions
- Smart appliances
- Industrial sensors
- Network-connected locks
- Building management systems
- Medical devices
Some devices may also remain in service for many years without receiving regular firmware updates.
This can leave known vulnerabilities exposed for long periods of time.
There is also an argument that says that because the IoT market is such a lucrative one at the moment, many manufacturers are in a rush to get products on sale, they neglect critical security processes that would otherwise be in place.
Supply chain firmware attacks
Firmware attacks do not necessarily have to begin after a device reaches the customer. An attacker could potentially compromise firmware somewhere within the supply chain.
If an attacker compromises the firmware development or build process, malicious code could potentially be incorporated into legitimate firmware before the device is shipped.
This creates a particularly difficult security problem because the organisation may receive a device that appears completely legitimate.
Firmware downgrade attacks
Firmware security is not only about installing malicious firmware. In some instances, attackers may also attempt to install an older, vulnerable version of the firmware which has an existing exploit ready to run against it.
This is sometimes referred to as a rollback or downgrade attack.
If a device accepts older firmware without verifying that it is still secure, an attacker may deliberately revert it to a vulnerable version.
This is why modern firmware security mechanisms often include protections against unauthorised firmware rollback.
How organisations can protect against firmware attacks
Organisations can reduce the risk of firmware attacks through several security controls.
- Secure Boot – Secure Boot helps ensure that only trusted software is allowed to participate in the boot process. The system verifies digital signatures before executing boot components, making it significantly harder for unsigned or unauthorised boot components to execute.
- Trusted Platform Module (TPM) – A TPM can provide hardware-based security functions and help establish trust in the boot process. It can store cryptographic keys and support mechanisms such as Measured Boot, where components involved in starting the system are measured and recorded. This can help detect unexpected changes to the boot environment.
- Firmware Updates – Manufacturers regularly release firmware updates containing security fixes. Organisations should therefore maintain firmware inventories, monitor manufacturer security advisories, apply firmware security updates, remove unsupported devices, and verify firmware update sources.
Firmware should be treated as part of the organisation’s patch-management process. - Firmware Integrity Checking – Where supported, organisations should verify that firmware has not been modified unexpectedly. The objective is to identify unauthorised changes before they become a persistent security problem.
Conclusion
Firmware attacks target one of the most fundamental layers of modern computing – the hardware of the device. Unlike traditional malware, which generally operates within the operating system, firmware attacks can operate beneath the operating system itself.
This can provide attackers with powerful persistence and potentially allow them to survive traditional remediation techniques such as reinstalling the operating system.
UEFI attacks, bootkits, malicious firmware updates, firmware implants and supply-chain compromises demonstrate the wide range of ways firmware can become an attack surface.
Modern technologies such as Secure Boot, TPM, Measured Boot and cryptographically signed firmware provide important protections, but organisations must also ensure that firmware is included within their vulnerability management, patching and incident-response processes.
Firmware is part of the security boundary — and attackers know it.