Study finds firmware plagued by poor encryption and backdoors

Firmware within the 'Internet of Things' could pose opportunities for hackers, researchers find

Home automation hardware devices controlled by Belkin's WeMo mobile application could be vulnerable to attack, which researchers attributed to a flaw in firmware contained on a system-on-chip that is also used in other embedded devices from different manufacturers.

Home automation hardware devices controlled by Belkin's WeMo mobile application could be vulnerable to attack, which researchers attributed to a flaw in firmware contained on a system-on-chip that is also used in other embedded devices from different manufacturers.

The first large-scale analysis of a fundamental type of software known as firmware has revealed poor security practices that could present opportunities for hackers probing the "Internet of Things."

Firmware is a type of software that manages interactions between higher-level software and the underlying hardware, though it can sometimes be the only software on a device. It's found on all kinds of computer hardware, though the study focused on embedded systems such as printers, routers and security cameras.

Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin.

They found a variety of security issues, including poorly-protected encryption mechanisms and backdoors that could allow access to devices. More than 123 products contained some of the 38 vulnerabilities they found, which they reported privately to vendors.

They're due to present their research next week at the 23rd Usenix Security Symposium in San Diego.

Most of the firmware they analyzed is in consumer devices, a competitive arena where companies often release products quickly to stay ahead of rivals, said Aurélien Francillon[cq], a coauthor of the study and an assistant professor in the networking and security department at Eurecom.

"You have to be first and cheap," Francillon said in a phone interview. "All of those things are what you should not do if you want a secure device."

Firmware security practices lag far behind those of the PC software market, where vendors like Microsoft learned the hard way that they need to patch software automatically on a regular, frequent schedule.

That's often not the case with firmware, which may not be designed to patch itself periodically and also relies heavily on third-party software that may not be current. In one instance, the researchers found a Linux kernel that was 10 years out of date bundled in a recently released firmware image.

"On these devices, it's a real nightmare," Francillon said.

The murky world of firmware sometimes makes it hard to figure out which products might be affected. Manufacturers often rely on tools and development kits that are widely used across industries, so the flawed firmware can end up in product sold under lots of different brands.

"As a consequence, some devices will often be left affected by known vulnerabilities even if updated firmware is available," the researchers wrote.

They also found problems in the way different firmware images employ digital certificates to enable encryption. They uncovered 41 digital certificates in firmware that were self-signed and contained a private RSA encryption key. About 35,000 devices were online using these less-secure certificates.

"Backdoors," or ways to access devices that have been cemented into the firmware's code, were also prevalent. It's a bad security practice, but developers often forget to remove backdoors before code is released or underestimate the ability of a hackers to find them.

The researchers searched the firmware images for terms that could indicate the presence of a backdoor, and they found 326 instances.

One of those instances, a backdoor in some Linux-based firmware, could allow a hacker to take control of a home automation device and potentially turn someone's lights off remotely, they discovered.

What was interesting is that they then found the exact same backdoor in 44 CCTV cameras from a different vendor, and in home routers from an unnamed "major networking equipment vendor." But it turned out the weakness wasn't really the fault of those vendors.

All the devices, it turned out, used a networking chip from another manufacturer, who had apparently left the backdoor in the firmware for de-bugging purposes. They weren't sure who the chip vendor was, but they planned to acquire some of the devices and do more research.

The study was also co-authored by Andrei Costin[cq], Jonas Zaddach[cq] and Davide Balzarotti[cq], all of Eurecom.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags siemensUSENIXXeroxBoschLG ElectronicssecuritySamsung ElectronicsbelkinD-LinkphilipsEurecom

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?