Firmware Weaknesses Can Turn Computer Subsystems into Trojans

The software that acts as the interface between a computer and its various hardware components can be turned into an espionage-focused implant because the companies that make the components often fail to create a secure mechanism of updating the code, Eclypsium stated in an analysis released today.

In its report, the enterprise firmware security company found that major turnkey design and manufacturing firms that supply components — such as Wi-Fi adapters, USB hubs, trackpads, and cameras — failed to sign their firmware, opening up the possibility that an attacker could replace the hardware code with a malicious version that could be used to spy on and control the compromised system. The company found devices that lacked signed firmware on Lenovo, Dell, and HP laptops, as well as unsigned firmware files on a portal from which computer users can download updates.

The findings are not surprising, says Jesse Michael, principal researcher at Eclypsium. In a standard laptop or workstation, more than a dozen different devices could be running firmware, and in a server more than 100.

Read the full article.