When a hacker wishes to gain unauthorized access to a device, but is unable to compromise its operating system, the next option is usually to target those programs responsible for running the hardware itself. Whether low-level software emulating a type of operating environment, or circuit-level software providing basic functions, these programs are rarely accessible to, or manipulated by, an end user.
The idea of a drone, robot or other form of artificial intelligence malfunctioning or going rogue may very well be a good example of a firmware attack, since an operating system, in this context, would require little-to-no input from a human user.
How a Firmware Attack Works
While most computer software adapts to the hardware it runs on, tapping into and modifying a device’s firmware yields absolute system control—something that is becoming increasingly difficult to achieve through application software and its hardened security measures.
For example, security researcher Charlie Miller discovered in 2011 that lithium ion batteries were being shipped with default passwords, giving hackers power over users who had them installed in their devices. Even upon reinstalling the device’s operating system, access granted through the battery allowed a constant embedding of malicious code. In other words, there is a true divide among the firmware, operating system and application levels. Those with direct access to circuit-level firmware can do what they please with your hardware.
Malware-infected firmware can effect computing devices in a number of ways. Compromised USB sticks and other removable media, for example, can be used to redirect the host computer’s traffic to predetermined addresses or URLs. In extreme cases, it can go as far as to alter system files and completely hijack the host device.
Should You Worry about a Firmware Attack?
It is important to note that not all physical devices are equally susceptible to a firmware attack. Some manufacturers like Apple have taken the extra precaution of digitally signing firmware before loading it on their electrical components and devices.
Also on the plus side is the fact of there being such a wide range of firmware for competing devices. Firmware only runs on compatible hardware and is very difficult to modularize since even its installation is a rather complex process. This means that a firmware attack is very specific and rarely of epidemic proportions. Given the number of Tech companies which manufacture one or more devices, it becomes virtually impossible for hackers to successfully alter firmware on a large scale.
Prevention and Remediation
Countering a firmware attack can become rather difficult since antivirus (AV) apps are of very little use here. Remember, these attacks usually occur just below the operating system level of a computer system. This means that an AV app, which runs at the application layer of your hardware, won’t be able to scan or detect foreign activity at your computer or device’s integrated circuit-level.
This also means that a large chunk of the responsibility lies within the hands of hardware manufacturers. Ideally, their firmware should be digitally signed, and subsequent authentication measures which check these signatures should also be employed. Some have even suggested that end users should take part in the verification process—particularly after the product has been in use.
Until then, the most important step you can take in protecting yourself against a firmware attack is to regularly check for and apply all firmware updates. Most manufacturers have simplified this process through alerts and easy-to-use interfaces. But for those devices which require more technical savvy (as is the case with home or small office routers), users must familiarize themselves with how to update system firmware and do so regularly. These cases, unfortunately, are the breeding ground for most firmware attacks.