Firmware Security for Devices

• Servers & Network
• Mobile devices
• Medical devices
• Automotive
• PC/Laptops
• IoT

Servers & Network
Any company has a network structure consisting of certain components, devices and technologies of various type and purpose. Those are routers, switches, gateways, VPN-servers, ICSs, EDRs, antivirus servers, VPI systems etc. Each component could be a part of a critical network or information infrastructure, therefore be of interest for a potential attacker. For this reason, it is extremely important to conduct a comprehensive security analysis and vulnerability research of this infrastructure, especially related to a remote access. This helps protecting critical data and ensure stability of business processes.

Mobile Devices
Mobile devices market includes a variety of devices, such as mobile phones with different OS (iOS, Android, HarmonyOS), smart watches, tablets and etc. Vendors constantly tend to provide users new OS capabilities and applications, new generation of devices. Any mobile device is built on a range of technologies. Each new option or OS update is an opportunity for a potential attacker to cause a severe impact.

Conducting security research of a mobile device may target firmware of any building block:

• Application Processor – main component executing mobile OS with all services and applications.
• Baseband Processor – an isolated component supporting wireless networks: cellular, Wi-Fi, Bluetooth.
• Security Processor – an isolated component supporting security technologies of a mobile device.

It is also extremely important to focus on security analysis of messaging and call applications widely used on mobile devices.

Medical Devices
Even though the security in this area is critical, medical sector is one of the most unexplored by security researchers. The area includes a lot of devices and firmware, and the vulnerability in those could lead to irreparable consequences. Mechanical hands, surgery hardware, cardio stimulators or heart rate monitors, Wi-Fi networks in medical facilities – all of them have data input sources which is an attack surface and a potential for external action and impact. That’s why the security in medical area must be cutting edge because any vulnerability could become a life-threatening one.

Data confidentiality is also extremely important point. Weak data protection leads to not only heavy fines and reputational risks but is also a threat to life and health of patients and medical staff.

Automotive
Automobile industry had already incidents with compromising cars controls. Modern cars are fully computerized, and an attack performed against vendor’s control system or against a single car could lead to AI’s incorrect decisions, technical issues that could lead to car accidents. Any car has a lot of built-in technologies, and many of them are connected to CAN bus: ECUs, power steering, brakes, infotainment system etc. All of them are potential targets for an attack.

Weak protection and vulnerabilities could also jeopardize an automotive supply chain impacting logistics and making a financial damage.

PC/Laptops
Attacks on personal or corporate endpoint devices such as PCs or Laptops is one of the most popular vectors, yet at the same time threat actors allows to discover and exploit new vulnerabilities on both software and firmware levels. The latter attack surface includes BIOS and the firmware for other low-level components supporting various technologies in a modern endpoint device. A successful compromising of any of this component would allow a potential attack to gain high privileges, execute code in an isolated environment that cannot be checked by a common protection software like antiviruses or firewalls. Such an attack could be remote and result in a malicious programs stored inside the firmware, hence cannot be removed by a simple OS reinstallation or a system scan.

IoT
Modern Internet of Things (IoT) – are billions of smart devices that open amazing opportunities for humanity, but at the same time they are a source of new and unexplored cyber threats. This implies privacy compromising, corporate intelligence, and any other malicious use of extracted data by threat actors.

If one has information about a vulnerability in a IoT device, remotely available via wireless communications, for example climate control system in an office or a house, the exploitation of the vulnerability could lead to extracting data such as space security, working and leisure hours, personal or business conversations. This data could be used for blackmailing or build other attacks against a company on this success.

For this reason, it is extremely important to take care about IoT devices security.