Study: Firmware Plagued By Poor Encryption and Backdoors 141
itwbennett writes: The first large-scale analysis of firmware has revealed poor security practices that could present opportunities for hackers probing the Internet of Things. Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin. In one instance, the researchers found a Linux kernel that was 10 years out of date bundled in a recently released firmware image. They also uncovered 41 digital certificates in firmware that were self-signed and contained a private RSA encryption key and 326 instances of terms that could indicate the presence of a backdoor.
Of course (Score:4, Interesting)
Re:Of course (Score:4, Interesting)
The manufacturer, so that it breaks, and we have a reason to go buy another expensive one or get it repaired.
Collusion, I tell ya!
Re: (Score:2)
"so that it breaks"
Manufacturers have been "hacking" your appliances to break prematurely long before the transistor was even invented
Re: (Score:2)
Yeah, they really are more short sighted, they only want *this* sale, which is the reason they cut the quality of things.
Of course, people feed this tendency by buying crappy products. Which sadly, makes the good quality products even more expensive because they can't benefit from the same economies of scale.
Keyboards, for example. When PCs cost $2000 (and $2000 meant something), $40 on a keyboard was barely noticeable.
Now the standard keyboard cost $5 and it shows. Issuing these keyboards to people expecte
Re: (Score:3)
Oh c'mon, at least skim TFA, I don't even expect anyone on /. to read it anymore, but at least click the link and look at the pretty pics.
This ain't about fridges and petty crap. I guess I needn't explain why being able to hack and modify the firmware of a CCTV can be quite interesting, or do I?
Re: (Score:2)
Anyone who's been here for more than a couple of days knows that the summaries are often extremely misleading.
Re: (Score:2)
Re:Of course (Score:5, Insightful)
It's not specifically about fridges, but it points to the widespread terrible security practices, and how a single vendor who makes the underlying stuff can basically destroy security for all of it.
As you add more and more stuff with the same vulnerabilities, the scope of the problem just gets magnified.
So, your internet connected CCTV, your smart TV, your notional smart fridge, and from the sounds of it possibly even your router ... these are all subject to vulnerability through their weakest links. And it sounds like there's a lot of weak links.
As long as these companies have a culture of lax security and other terrible practices like this, this problem isn't going to go away.
Re:Of course (Score:4, Interesting)
I'm a firmware engineer, and although I tend to work a bit below the level being talked about here I can understand why security often plays second fiddle. When you are producing mass market products you are going to get significant support issues, and there is pressure to minimize them as much as possible by making stuff "just work". Unfortunately that is the enemy of security too.
Look at it this way. Wifi needs a password, but apparently actually knowing the password and figuring out how to type it in is too much to ask of the user. Thus WPS was invented so now all you have to do is push a button, even if it does introduce some fairly severe security flaws.
It isn't impossible of course. Panasonic use FreeBSD for their smart TVs and they remain fairly secure. The thing is Panasonic doesn't sell super cheap TVs, or in other words you pay a bit more for a well engineered product. Many people just want to pay as little as possible, but also want cutting edge technology. I say let them have it - eventually they will get the message that cheap stuff is usually crap.
Re: (Score:3)
Those household appliances are small potatoes compared to autos. The car companies outfit our cars with computers but give us no decent way to connect up our PCs or handhelds and have the vehicles tell us what ails them. Why? The conditions that generate sensor signals can be complex and the car companies are essentially saying "we do not understand our vehicles that well"...and it 'tis but a short step from that to forcing you into a dealership or auto repair shop just to "read and reset the computer".
Okay
Re: (Score:3)
The problem is that bugtastic firmware is just a sign to the "good enough" race to the bottom that plagues a lot of industries.
Secure firmware upgrades are not rocket science. If a device doesn't have to be connected to the Internet [1], a SD card [2], a routine for signing firmware, and having an atomic transaction based upgrade process (so the upgrade either 100% completes or gets rolled back... no in between states) will solve this. Of course, some way to revert or roll back would be useful. Perhaps a
Re: (Score:1)
Right, because bugs in the cannot-be-replaced version 1.0 firmware will never come back to haunt you. (read: force it to fallback to 1.0, and bob's your uncle.)
Not safe (Score:3)
SD Cards can be several devices, including wifi cards, so those are just as (un)safe as USB devices if the device they are connected to would be susceptible to hot plugged hardware and have the drivers available for those.
SSL/TLS is plagued with bugs due to the backward compatibility issue. Heartbleed anyone?
Self Signed shouldn't be a problem, providing the device has the pubkey for the CA that was used to self sign present.
Doing a wget on an image requires at least a minimal install like busybox on top
Re: (Score:2)
Secure firmware upgrades are not rocket science.
True, but they do cost money. You need a processor capable of handling the crypto, which rules out a lot of low cost parts. You need extra memory to store the original factory firmware for factory resets and extra memory for storing the new firmware in case the upgrade fails (power cut etc.)
Also, if you are going to require SD card you had better ship a free one along with an SD card reader with your product, or expect a lot of customer support calls. USB is starting to become acceptable, but only just.
The
Re: (Score:2)
The advantage of SD cards is that in a pinch, the manufacturer can always ship a SD card to the customer (especially if the item is a more expensive appliance like a CNC mill.) As for a SD card reader, those are not too difficult to find (most modern laptops except MacBook Air models tend to have them built in.)
I do agree that a USB flash drive would be better, but a SD card reader is fairly static. One knows that it will have the same device ID (in Linux) or drive letter (in Windows) no matter what, whil
Re: (Score:1)
Re: (Score:2)
Once you have IPV6, with no (supposed) need for firewalls, everything connected to the interweb, and widespread terrible security ... I predict your fridge will be hacked as quickly as an unpatched Windows XP box hooked up to the internet.
People will try to have anything, and when the device manufacturers are this slack about security, it will get hacked simply because it's there.
I've always thought the internet connected fridge was a stupid idea, for these exact reasons.
With the laundry list of terrible se
Re:Of course (Score:4, Informative)
Once you have IPV6, with no (supposed) need for firewalls.
Why does somebody always have to trot this out? IPV6 does not mean no need for firewalls. It means no need for NAT. These are not the same thing. Please, please stop spewing this crap.
Re: (Score:2)
Because every time IPV6 comes up, people say "you won't need a firewall", which I've always assumed to be crap, and which is why I put "supposedly".
Because my reaction is always "no way I'm running without a firewall".
I still think the "no NAT" thing is stupid. I don't want devices with a globally unique ID, because the marketing assholes any everybody else don't need to know "this is Bob's fridge".
Re: (Score:2)
Re: (Score:2)
Why on earth would you ever use IPv6 on an internal network?
Re: (Score:2)
Because if you didn't, when (he he....maybe "if") the entire Internet finally switches to IPv6, you'd have to run 4to6 hacks on your router, and probably have large swathes of the Internet unreachable, because your IPv4 internal network doesn't have the capability to properly address the IPv6 address space.
Much easier to just use IPv6 internally to begin with.
Re: (Score:2)
I didn't say "Why wouldn't you have a IPv6 capable network" I asked "Why would you use IPv6?" All my equipment/OS's can handle IPv6 just fine, but there's no reason to ever use it inside a local network. I can hit IPv6 outside my network just fine... http://test-ipv6.com/ [test-ipv6.com]
Granted, that's entirely up to your ISP. But out-of-the-box equipment that's IPv6 capable equipment should support IPv6 as long as your ISP does as well.
Re: (Score:2)
I didn't say "Why wouldn't you have a IPv6 capable network" I asked "Why would you use IPv6?"
Well, it's a good thing that I actually answered the second question, rather than the first, isn't it?
All my equipment/OS's can handle IPv6 just fine, but there's no reason to ever use it inside a local network. I can hit IPv6 outside my network just fine... http://test-ipv6.com/ [test-ipv6.com]
Granted, that's entirely up to your ISP. But out-of-the-box equipment that's IPv6 capable equipment should support IPv6 as long as your ISP does as well.
If you only run IP4 internally, then you can only address, at best, a subset of IPv6 addresses on the public Internet.
Re: (Score:2)
Considering the smallest recommended handout is a /64 which includes as many addresses as there are in IPv4 total there should never be a problem with the number of addressable IPs you receive. If ISPs try to hand out a /127 address to customers they'll lose many of the auto-routing functions of IPv6 that keep the router tables small and raise their own costs. My bet is they won't give you a static IP without a charge, but you will be given that /64 address and you won't be buying packages of IP addresses.
Re: (Score:2)
Because every time IPV6 comes up, people say "you won't need a firewall",
IPv6 capable consumer routers have SPI (Same as NAT - no incoming connections) except without resorting to packet mangling or dangerous ALGs.
I don't want devices with a globally unique ID, because the marketing assholes any everybody else don't need to know "this is Bob's fridge".
If not turned on by default, enable IPv6 privacy extensions on the fridge console next to the designer ice cube shaper display.
Vendors have thus far proven themselves incapable of providing "connected" products not intentionally designed to maximally violate your privacy or otherwise place you at mercy of vendor operated "cloud service".
The second Bob's fridge connects
Re: (Score:3)
Once you have IPV6, with no (supposed) need for firewalls
Um... you'll still need a firewall. You just won't need a NAT gateway.
Re: (Score:2)
http://www.cbsnews.com/news/ha... [cbsnews.com]
China embedding chips in electric kettles and using the other appliances in the home to pry into home networks on the off chance that you're someone worth hacking.
Beyond that, hacking someone's fridge is a great way to be irksome to someone you don't like -- I've come home to a failed fridge after a week-long trip and it is definitely not pretty.
Re: (Score:2)
Well...now, lessee...an out of date linux kernel...I'll go out there on a limb and guess it was an OpenMOSIX kernel. That seems about the right timeframe. A cluster computing platform, brilliantly simple. Just think of all those appliances donating spare cycles and ram to a money making scheme by the vendor, selling super computing time on your appliances and bandwidth.
O.K. that's my vote for what this is rally all about.
Re: (Score:2)
1. The fridge could be used for pivoting> into your network [wikipedia.org]
2. If the fridge is able to automatically purchase food for you, the payment system could be abused
3. If the fridge is able to automatically purchase food for you, the ordering system could be abused.
4. It could be used to disable the cooling system
5. It could be used a
Re: (Score:2)
> Who's going to hack your fridge?
If your fridge is tied into your grocery shopping (which would seem to be a major reason to have a smart fridge... really, a dumb fridge is just fine at turning the compressor on and off), then you might be able to hack it and buy neat stuff and get it delivered to a drop location (even the owners own driveway ... "Yeah, I'll be out, drop it behind the paper recycling bin...").
Re: (Score:1)
Re: (Score:2)
Someone who wants you to die ? How hard would it be to increase the temp to "just" above the safe point (so bacteria/etc. grows) ?
Ingest the food, Get botulism or something else and die.
Re: (Score:2)
Someone who puts a network cable into it.
No, I'm not going to give the fridge a password into my wifi. Why should I? And I'm certainly not going to pay for a cellphone service for it.
And forget patches (Score:2)
You'd think by now some consortium would self-assemble to devise best practices and certifications. In all likelihood it will have to be non-industry parties that do so as the last thing Samsung, et al, want is another hassle to eat into their razor-thin mar
Re: (Score:1)
Self signed-certificate?? (Score:2)
Re: (Score:2)
>> "Self-signed cert = At least the NSA cant sniff the traffic so easily"
I hope you're joking, but in case you're not, reread the part about the published "private RSA encryption key." That means that ANYONE who watches an SSL/TLS session get established with that key could decode the session's traffic. And more bad things...
Re: (Score:1)
If, instead, the printer created a random self-signed certificate on first boot and the printer driver asks the user on a certificate change 'printer xyz appears to have changed its fingerprint, did
Yes, much of this is unrealistic (Score:3)
Getting a signed certificate for an embedded device may cost more than manufacturing the device... per year.
It's actually worse than that, because you don't even have a fixed target to price up. You have to consider how long a certificate needs to be valid for, the longer the more expensive but if it's not enough for the working lifetime of the device people are going to get upset. There's also the risk that a link in the certification chain could disappear, which is presumably more likely the longer the certificate lasts. For serious equipment running on corporate networks you might also have to consider letting
Re: (Score:2)
"but we totally found backdoors on it. the fridge firmware totally has the 'door' string xxx times"
Re: (Score:2)
Depends on what "self signed" means. Companies can definitely have our own root key and devices have certs that chain back to that, but the devices will not sign themselves. That is no less secure than relying on some third party root cert.
Re: (Score:2)
But the client's browser is not likely to have the company's certificate as trusted, so they still have to accept an unknown certificate. Just not the device's, but the manufacturer's. :)
Do you think average joe would actually verify his printer's certificate for authenticity?
This is only likely to happen in a large corporate network.
Re: (Score:2)
Ah, I wasn't talking about browsers being involved. Certs are used for much more than browsing. A peer to peer network would have shared root certificates, or devices from the same manufacturer, or can validate that the firmware upgrade is legitimate and provided by the manufacturer.
Re: (Score:1)
The issue is that it's embedded in the firmware, which means it's the same damned certificate on every device. Hack it once, and every one of them is now hacked. (remember the issue with debian and sshd keys? there were only a handful of keys because they were generated with a guessable random number (seconds from boot) on the first boot.)
Not the same certificate on every device (Score:2)
Re: (Score:1)
RTFA. They downloaded the installable firmware images for many devices and found a self-signed certificate in some of them. That is not a per-device-unique anything. Every device loads the same blob, and has the same certificate. They aren't even competent enough to get the device to generate it's own certificate. (which could have it's own issues, but at least it has a chance of being different from any other device.)
The beginning of the "internet of things" (Score:5, Insightful)
It will be like the internet of humans was. Everyone will be in a gold fever. Everyone will want to join the train and everyone just HAS to get with the latest fad and have a sock drawer that has some kind of internet connection. Every petty, crappy, useless gadget will need to have some sort of internet access.
And of course the manufacturers will deliver it. Everything and their dog collar will be online.
Then the first people, I'd predict some geeks with a rather odd sense of humor, will start to piss people off by "talking" to their fridge and telling it to put some milk bones and condoms on the next shopping list, just to make your friends wonder about your ... private life should they get their hand on it.
And given time, someone will come up with a way to abuse the whole shit not just for fun but also for profit. And only THEN we'll stand there and ask why oh why security has not been a core topic right from the start because that should have been obvious... and it probably was.
It was just way cheaper to ignore it. And as long as people buy it (who will react just like the very first person in this thread, i.e. "who's going to hack your fridge?"), why bother with security? Security costs money and it's no selling point. So... to the crapper with it.
Re: (Score:2)
Re: (Score:1)
That's how language works. Deal with it.
Dealing with such toxic bullshit only ensures it will spread around more, even if only slightly. I'd rather point out why it's garbage.
Re: (Score:2)
Re: (Score:1)
It's toxic garbage. I reject numerous ridiculous terms, regardless of how long they've been around.
Re: (Score:3)
Re: (Score:3)
That's how language works. Deal with it.
Dealing with such toxic bullshit only ensures it will spread around more, even if only slightly. I'd rather point out why it's garbage.
Yes, but the entire article is low-brow drivel. I have no idea why this was the source they chose to link to (though it might go a long way toward explaining the tone and content of Slashdot's discussions these days...). I mean, check out this para:
The murky world of firmware sometimes makes it hard to figure out which products might be affected. Manufacturers often rely on tools and development kits that are widely used across industries, so the flawed firmware can end up in product sold under lots of different brands.
It's hard to know whether this 'writer' even teh English. But worse, the content is almost anti-information. What the fuck is a 'murky world'? People use generic toolkits? Sold to more than one company?! Who is this Adam Smith and where do I get his pamphlets?!?
W
Re: (Score:2)
Seems like I spent too much time with the marketing goons lately... I hope I'll recover soon. :)
But seriously, you know the buzzword and I doubt that we'll get rid of it anytime soon. It's like the cloud, just worse, because, as you point out, it makes no sense really.
What matters now, though, is that we know what we're talking about. Maybe "the internet of everyday items" simply didn't have as much zing.
Re: (Score:3)
Need? What kind of outlandish concept, how does "need" come into the equation when we want to make people buy crap?
really? (Score:4, Insightful)
Re: (Score:2)
In fact, who really needs a fridge at all? We got along just fine without them for thousands of years.
Re: (Score:1)
Re: (Score:1)
Auto-generate a shopping list based on the contents of fridge and cupboards? I don't know about anyone else, but from week to week, season to season, the contents of my fridge vary wildly based on what's locally in season and the random recipes I choose for the week. My eating patterns aren't exactly predictable unless you hack my random recipe selector.
Re: (Score:2)
Re: (Score:2)
There will be people employed to create software and hardware interfaces, test the interfaces, and finally when it breaks down or exploited, to fix them.
At least its going to be some extra buttons or a panel on a fridge...there is not going to be a significant hit to the environment. So lets not use the argument "what is the need".
"Internet of Things" (Score:1)
worst new term since 'the cloud' and 'hashtag'.
Re: (Score:2)
It's hella lame.
Re: (Score:3)
Unfortunately, I'm sort of being put into this area now. But this term covers so much stuff, a lot of which has existed before the term existed. The stuff that's eye rolling are bluetooth enabled devices that talk to phones, that's not really the internet of things. But something like a stoplight could be internet of things, if it reports back when a bulb has burned out; it's a thing, it is on some private network, and it is something not traditionally networked in the past. Similarly, smart meters, tra
Going to need MUCH better firewalls (Score:3, Interesting)
I can't ever see secure firmware becoming the norm given the economics of consumer goods, so I think we're going to need much better firewalls than what we see in SOHO routers currently.
Port/address level control is spectacularly insufficient when everything runs on port 80, and nobody is going to spend time mapping out specific source/destination pairs for everything (The washer can talk to the dryer. The washer can talk to my smartphone. The dryer can talk to my smartphone...)
I'd like to see something like a home-PKCS standard where:
1. Any IOT device requires a client certificate supplied by the router
2. The router drops any traffic not signed by a recognized client certificate
3. The router's signing key must be kept on a seperate USB drive, and the WAN port is locked out if the USB drive is inserted.
To set up a new device on your home network you would:
1. Insert USB key into the router (WAN port shuts down)
2. Generate a new client certificate for the new device (push button "a")
3. Install the certificate on the new device (push button "b" on router and also on device within 60 seconds, enter PIN, something automated like that)
4. Remove USB key from router (WAN port comes back up)
The router will now pass signed traffic to/from your new device. Traffic not signed? No talking to IOT devices for you.
Yeah, key management sucks, but I bet it could be fairly easily automated for home use. It would take more thought and detail than I've outlined above, but should be doable. Unfortunately, that would require that everyone agree to follow the same standard for home-PKCS, and I can't see that happening either.
Plus cheap devices would have the crypto implemented badly, plus you wouldn't be able to turn on the microwave from your office, so on and so forth.
Never mind, I give up.
Re: (Score:1)
Better idea: Give up on this stupid everything-as-to-be-on-the-Internet bullshit. I'll laugh when people buy all these expensive appliances only for malicious people to find ways to fuck with them.
Re: (Score:3)
Well, yes, that actually IS a better idea.
OTOH, if an IP-connected hot-water heater is the only kind on the market next time I need a new one, I'd prefer to have the 'securing it' worked out in advance, because I'm sure not going to do without.
Re: (Score:2)
Re: (Score:2)
Well, you could, you know, NOT CONNECT the IP enabled water heater to the Internet.
Re: (Score:2)
Well, you could, you know, NOT CONNECT the IP enabled water heater to the Internet.
Except, in the future, the only way to set water termperature will be through a web interface, and you'll need it connected to download firmware updates so it doesn't explode due to a random memory corruption bug causing it to leave the gas on all day.
Re: (Score:2)
Fortunately, a water heater is simple enough that you can rip out the "smart" electronics and replace them with the sort of thermostat-and-relay circuit that almost everything uses right now.
Re: (Score:2)
Well, you could, you know, NOT CONNECT the IP enabled water heater to the Internet.
What if that's not a choice, either?
or
Do these scenarios really seem too far fetched or unlikely?
Doesn't really solve the problem (Score:3)
Better idea: Give up on this stupid everything-as-to-be-on-the-Internet bullshit.
That's a good idea, but it doesn't solve the problem for devices that actually do have good reasons to be connected: streaming media players, IP-based phones/faxes, consoles with multiplayer games, and so on. Many of these devices are connected to household networks these days, both to access the Internet and to communicate for legitimate reasons with other devices also on that home network. The devices themselves or other devices on the home network may store sensitive data. They may also have sensors, and
Who moved m -- Make your own damn cheese (Score:2)
And if you don't like it, stop eating the fucking cheese, mouse.
It'll still be possible to get off your duff and make your own damn cheese [amazon.com], won't it?
Re: (Score:2)
Paring could be done via NFC. A small 'Key' passed over the 'pairing' pad of the server and any devices could sync them all to the same cert. If for some reason it is believed the cert is compromised a new $1 'Key' can reset every device and the server to a new cert.
Simpler than the wifi and bluetooth mod
Crowdsource it (Score:2)
We really need a program that offers bounties for finding such vulnerabilities and backdoors. Put a tax up for companies selling networked devices, pay bounties from that when a third party finds something and pay the money back to the respective companies after a year or two when nobody finds any vulnerabilities in their products. This would make actually putting some effort into secure products commercially viable while giving good hackers a way to earn their living in a good way. Win-win.
Right now we're
mod parent up (Score:2)
here's the reason, expert opinion (Score:1)
This is commonly because the guy who originally set up the image, knew how the code worked, and designed the thing was laid off years ago. The people hired on to maintain it afterwards never figured out how it worked or how it was put together, their goal was just to keep things running. I was recently laid off at a job where I had bothered to take the time to learn how the original image for a device was created and recreate it from scratch so that we wouldn't be left behind and could upgrade. The guys rem
What's wrong with a 14 year old kernel? (Score:3, Insightful)
If it works on the hardware in question, what's wrong with that? Sometimes being newer isn't better, it's just newer.
I don't see this as a huge problem for embedded systems.... Unless it's something like a firewall or a router that lives on the internet, then it *might* be worth looking at. If it's something like a media player or printer on your private network, who cares? (unless you are member of the tin foil hat society).
i was going to argue engineers vs. programmers (Score:1)
Idiots and their "BSP"s (Score:3)
The reason embedded device kernels never get updated is because the source code for them is on some SOC vendor's way out there fork of some ancient kernel that nobody with a clue actively develops for anymore.
And the vendor (say, TI) had hired a bunch of clueless interns to write the "BSP"s (old acronym from the binary blob obsessed asshats at vxworks et al) for their SOCs and the cluster of shoddily designed peripherals crowbarred into the SOC.
And those interns wrote code so toxic and broken that no sane kernel developer would ever have accept any of their garbage into any mainline kernel tree.
So there are all these embedded devices out there with kernels from the 90s, and it would take time (and expertise) that none of the vendors have (including the SOC suppliers, like TI) to merge the changes into something even remotely contemporary.
All of this because the requirements for these embedded projects (dictated by clueless PHBs) is only "linux support" not "mainline kernel support", so SOC vendors (like TI) just don't have the incentive to develop SOC peripheral driver code suitable for mainline inclusion.
Re: (Score:2)
And you can't just migrate the patches to latest kernel ... because some the key peripheral parts (video controllers and audio/video encode / decode engines) are binary blobs. Grrrr like TI, NVidia, Qualcomm, Exynos(Samsung), RockChip, AllWinner, MTK, and Freescale. If you *can* forgo those parts then you can migrate to a recent kernel.
This is in part because a modern SOC is just a collection of assembled IP and the upstream video [OpenGL ES] and h264 encoder/decoder hardware vendors in particular won't all
Re: (Score:2)
Absolutely. The situation is not sustainable.
Even worse, because every SOC is a haphazard pile of random and arbitrarily buggy peripherals, there is no deterministic way (at run time) to enumerate all of the peripherals, and thus which various driver variants (and even worse, binary blobs) are required to make them work.
So by definition, none of this can EVER go into the mainline. Every kernel fork is its own disconnected universe, dedicated to a single snapshot of a single SOC and its particular collection
You're talking about our back doors? (Score:2)
https://www.youtube.com/watch?... [youtube.com]
Why is it called "firmware"? (Score:2)
When you can rewrite it with software? Not all progress is good. I want to see black hat types remotely reprogram ROM chips and UV-eraseable EPROM chips from the 1980s.
Wall of Shame (Score:2)
Answer: lemon laws (Score:2)