XIoT Firmware Security

Extended Internet of Things (XIoT) devices are commonly seen as black boxes. The firmware XIoT operates on is largely unknown to most asset owners and sometimes even to the device manufacturer. As devices move down the factory line, hardware and software are added and packaged up in preparation for the market. Are device manufacturers aware of every component that goes into their products? Who is inspecting the final product for vulnerabilities and what security assurances can a manufacturer give their customers? 

The problem is compounded by the fact that there is little control exerted over the security features of devices, and it’s never top of mind. While you can easily add antivirus protection and configure controls for a laptop, it’s nearly impossible for XIoT devices.

Other firmware security challenges manufacturers face:

• Complexity related to having multiple suppliers and sources in firmware supply chains
• Lack of tools to inspect the final product firmware 
• End user inability to customize device configurations and improve security posture 
• Shipping with default settings the end user is expected to change (but doesn’t)

Firmware vulnerabilities can be exploited just like any other device vulnerability. Without adequate remediation of device risks, hackers can go undetected for longer periods of time. While firmware or software components within XIoT devices such as printers may not be a hacker’s ultimate goal, unaddressed vulnerabilities within firmware and software can provide easy access to higher-value targets within an organization. 

Examples of how hackers exploit firmware vulnerabilities 

• A backdoor is created either intentionally (by a hacker) or unintentionally (by the device manufacturer or end user)
• A device comes with hard-coded passwords and no option to change them
• A device comes with a standard password, but the asset owner doesn’t change it

What happens during an attack on an XIoT device

Typically, an attacker finds an unaddressed vulnerability within the firmware or software supply chain. Once compromised, the device can be leveraged as the attacker sees fit. Users may notice the device exhibiting abnormal behavior or be unable to login to or control the device, or there may be little to no signs of incursion.

Attacks can also occur when an asset owner receives a disingenuous firmware or software update and loads it into a device thinking it is a normal update, at which point the device is compromised. 

Examples of how this happens:

• Mirror sites: Instead of typing the correct, official web address, a user types in the wrong URL, taking them to a mirror site of the site they are familiar with when downloading updates. If the user goes through the process of logging in and downloading an update from the mirror site, it could compromise their device. 
• Phishing emails: An email may look like it comes from a big OEM, but it’s actually a phishing attempt. If the user clicks through and downloads the update, they’re compromised.
• Vendor update process compromise: In rare and unfortunate cases, compromised vendors have unknowingly delivered a hacker’s payload via apparently official update processes. In these unusual circumstances, it is especially critical to have the capability to assess patches before deployment.

Attackers also use vulnerabilities as distractions to get to their end goal. They may make your printer malfunction, so your security team’s focus is there while they work their way deeper into your network. 

Firmware updates typically come at the recommendation of the device OEM. If the update is security-related, install it as soon as possible. Again, be wary of phishing and make sure firmware is genuine by verifying it with the OEM. NetRise customers can take the additional step of analyzing the new firmware version for vulnerabilities before deployment, enabling safer procurement and patching.