- Jan 8, 2011
- 22,361
The first large-scale analysis of a fundamental type of software known as firmware has revealed poor security practices that could present opportunities for hackers probing the "Internet of Things."
Firmware is a type of software that manages interactions between higher-level software and the underlying hardware, though it can sometimes be the only software on a device. It's found on all kinds of computer hardware, though the study focused on embedded systems such as printers, routers and security cameras.
Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin.
They found a variety of security issues, including poorly-protected encryption mechanisms and backdoors that could allow access to devices. More than 123 products contained some of the 38 vulnerabilities they found, which they reported privately to vendors.
They also found problems in the way different firmware images employ digital certificates to enable encryption. They uncovered 41 digital certificates in firmware that were self-signed and contained a private RSA encryption key. About 35,000 devices were online using these less-secure certificates.
"Backdoors," or ways to access devices that have been cemented into the firmware's code, were also prevalent. It's a bad security practice, but developers often forget to remove backdoors before code is released or underestimate the ability of a hackers to find them.
The researchers searched the firmware images for terms that could indicate the presence of a backdoor, and they found 326 instances.
One of those instances, a backdoor in some Linux-based firmware, could allow a hacker to take control of a home automation device and potentially turn someone's lights off remotely, they discovered.
Read Full Story: http://www.itworld.com/security/431186/study-finds-firmware-plagued-poor-encryption-and-backdoors
Firmware is a type of software that manages interactions between higher-level software and the underlying hardware, though it can sometimes be the only software on a device. It's found on all kinds of computer hardware, though the study focused on embedded systems such as printers, routers and security cameras.
Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin.
They found a variety of security issues, including poorly-protected encryption mechanisms and backdoors that could allow access to devices. More than 123 products contained some of the 38 vulnerabilities they found, which they reported privately to vendors.
They also found problems in the way different firmware images employ digital certificates to enable encryption. They uncovered 41 digital certificates in firmware that were self-signed and contained a private RSA encryption key. About 35,000 devices were online using these less-secure certificates.
"Backdoors," or ways to access devices that have been cemented into the firmware's code, were also prevalent. It's a bad security practice, but developers often forget to remove backdoors before code is released or underestimate the ability of a hackers to find them.
The researchers searched the firmware images for terms that could indicate the presence of a backdoor, and they found 326 instances.
One of those instances, a backdoor in some Linux-based firmware, could allow a hacker to take control of a home automation device and potentially turn someone's lights off remotely, they discovered.
Read Full Story: http://www.itworld.com/security/431186/study-finds-firmware-plagued-poor-encryption-and-backdoors
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}
