Firmware Attacks: An Endpoint Timeline

One of the most common questions I’ve heard regarding the need for firmware security is “Could you provide examples of real-world attacks”? I began to research the history of attacks against firmware inside your computer and uncovered quite a list of various pieces of malware with firmware-based attack capabilities. For many, the firmware attack vector falls into the “out of sight, out of mind” category. I don’t fault people for this train of thought, after all, firmware should be something that most people don’t have to worry about. However, firmware ends up embedded inside our PCs, servers, and laptops and lives in several different components. The central question is “Can you trust the hardware and firmware in your computer?”. Of course, if these components are “out of sight, out of mind”, you may not be asking that question. If we are to trust the hardware and firmware in our computers this means, at some level, we have to trust the supply chain. Has the firmware been tampered with to include a backdoor or unintended behavior? Are there vulnerabilities that attackers could exploit to gain highly privileged access to my system? Attackers are increasingly exploring these exposures in our systems, but why?

Motivations For Attacking Firmware

• Impact – Almost nothing enjoys higher privileges than firmware. If the goal is to disable or destroy a system, firmware possesses some of the highest levels of privilege in the stack. As attackers increase their own permissions, the amount of damage they can also do increases. 
• Availability – UEFI standardized the interaction between hardware and software on most modern computers. Before UEFI each OEM had a different BIOS, making ubiquitous attacks more difficult.

• Increased Attack Surface – UEFI also introduced a vast attack landscape as it represents an increase in features and functionality at the firmware level. 

• Highest Level of Trust – Firmware often represents a level of access to hardware and software that can defy controls at other levels (Such as the operating system and applications). Attackers typically exploit this trust for the following goals:
  • Stealth – Most attackers’ primary goal is to gain control of a system covertly. The likelihood of being detected decreases as the level of permissions increases. Attackers controlling a system in the highest privilege levels (e.g. Ring -3 as described in the Intel ME article as an example) therefore have the best chance of going undetected. In order to reach these levels of privilege, attackers often go after firmware.
  • Persistence – Attackers understand there is always a chance of being detected. The deeper into the system an attacker can control the better they can configure malicious software to lie about its presence and persist for longer periods of time. 

• The Exploitation of Supply Chain Weaknesses – While there are various examples of attackers going after the weaknesses in the supply chain (most notably SolarWinds and Log4j), much of the firmware attack surface has even more serious supply chain security impacts. Each of the components within your system has slightly different supply chains. Hardware and firmware are acquired from various suppliers before being baked into your computer. Attackers could exploit the supply chain directly, infecting component firmware early in the process with backdoors. Vulnerabilities or configuration mistakes can be introduced (or exploited) at various stages in the supply chain. More complex attack chains could be formed by taking advantage of several mistakes along the way, such as not implementing newer protection mechanisms made available by hardware manufacturers in firmware.

• The Difficulty of Remediation – Firmware is typically not easy to recover or reinstall on a system, and many practitioners will avoid “reflashing” even actively-exploited firmware. Due to the complexity of the firmware supply chain, it may not be possible to implement a fix in the current hardware. Configuration often cannot be changed by the end consumer, leaving you waiting for upstream hardware and software vendors to implement a fix and push new firmware (which, in some cases, may never happen).

Malware authors are taking advantage of the above weaknesses, including vulnerabilities below the surface and inherent supply chain issues. Below is a list of real-world examples. While not a comprehensive list (as there are some additional “fringe” cases), these events represent the most common and visible examples:

Click here to download the full timeline

Conclusion

There will likely be more examples of malware to add to the above list. As attackers run into challenges at the operating system level, diving to the firmware level is the next logical step to evade detection. Ensuring the firmware on your systems is important, as is making sure protections such as Secure Boot are enabled and configured properly (and each of those is not always an easy task).