Firmware Looms as the Next Frontier for Cybersecurity

Last December, researchers discovered a series of five vulnerabilities affecting servers run by more than a dozen major vendors — brand names like Huawei, Qualcomm, Nvidia, AMD, Dell, and HP. The vulnerabilities were nothing to scoff at, either, with CVSS scores ranging from 5.3 (Medium severity) to 9.8 (Critical).

The bugs live in firmware developed by American Megatrends International (AMI) for processors it manufactures known as baseboard management controllers (BMCs). BMCs are chips that sit on motherboards, allowing administrators to monitor and manipulate essentially anything on a machine — from applications and data all the way down to low-level hardware — even without an Internet connection or while the host is turned off (as long as it's receiving power).

"So this is obviously a really interesting place for attackers to be," says Nate Warfield, director of threat research and intelligence for Eclypsium, the firm behind the disclosure. "If they can get into this mini-computer that's always running, they now have remote admin access over whatever they want."

But this discovery was merely a speck on the surface of a much greater problem. In a May 11 presentation at Black Hat Asia, Warfield and Vlad Babkin, security researcher at Eclypsium, are going to argue that AMI's BMC bugs were evidence of something bigger, and more structurally problematic, in firmware security.

"The message is definitely not the vulnerabilities themselves," Babkin states, unequivocally. "It's much, much deeper. Because even if we go ahead and fix these vulnerabilities, it's not going to fix the root issue."

The Risk in Firmware

When organizations harden themselves to tried-and-true tactics, techniques, and procedures, attackers need new ways to get where they want to go.

"All of these endpoint detection and response (EDR) products — they're not perfect, but they do slow people down," Warfield says. "And because of this and all of the other defenses that are being developed, attackers need to find a place where they can start to sort of evade this stuff."

Warfield and Babkin think firmware can be that new place they go to.

"If we look back 10 or 15 years ago," Warfield continues, "the only groups really capable of attacking at a firmware level were your nation states — your Russians, your NSA — you know, the really well-funded organizations. But now it's becoming a lot easier. There is a proliferation of tools that help you get into firmware." And the power that a firmware breach affords is often far greater than what can be achieved by typical software-based means.

"Let's just put it this way," Babkin muses. "Firmware is A) a private, privileged component — it's crucial, and you can't take it away because of what it is and what it does; B) it's a gray area, because many security products and tools actually aren't able to look into it; and C) it's exploitable."

Exploitable to say the least. In the innards of a machine, firmware is one of the most privileged places a hacker can find themselves. "If you're a ransomware group and you can get into something like a BMC, you can ransomware the whole network," Warfield says, as just one scenario among many. "Even if they decide to not pay the ransom, pull the hard drives, reformat and reinstall everything — if you're in their BMC, you can just come back and do it again. Right? They're not going to get rid of you, because they don't really know where you are."

If firmware is the new frontier, enterprises will need to dedicate more time, energy, and resources to this untapped plane of security. But are we even ready to have that conversation?

Can You Secure What You Don't Know?

Babkin hesitates to just list off easy tips and tricks for firmware security. "Honestly," he says, "there's advice I could give on a technical level, but really it's more than that."

As he and Warfield see it, there's a core issue with visibility in firmware today, and it's getting in the way of security. "I mean, one of the biggest issues in our research was just trying to find what exactly was running," Babkin laments. Companies that might otherwise want to address their firmware security could have a difficult time simply figuring out what exact firmware they're running, and where it all comes from.

To help explain, Warfield draws a parallel with poisoned NPM packages. Bad open source packages cause a supply chain nightmare, both because of how widely they spread and because companies often don't actually know about all the software they have installed.

"AMI sells this BMC as a library," Warfield points out. "So you may have a server from Dell, and you may not actually know that your BMC code is from AMI. That just makes everything take longer, because AMI has to sell the fixes to the OEMs, the OEMs have to package it, and then you have to install it."

And so, if more attackers start jumping on the firmware train, it'll require more than good cyber hygiene to stop them. As Warfield says, "It's not a quick 'Patch Tuesday' type of thing."