Five years after the Equation Group HDD hacks, firmware security still bad

guest · Feb 18, 2020

Five years after the Equation Group HDD hacks, firmware security still bad
Device manufacturers are not forcing driver signatures at all times
February 18, 2020
https://www.zdnet.com/article/five-...roup-hdd-hacks-firmware-security-still-sucks/

In a report published today, Eclypsium, a cyber-security firm specialized in firmware security, says that the issue of unsigned firmware is still a widespread problem among device and peripheral manufactures.

According to researchers, many device makers still don't sign the firmware they ship for their components. Furthermore, even if they sign a device's firmware, they don't enforce checks for the firmware signature every time the driver/firmware is loaded, but only during installation.
To prove their point, in their report, the Eclypsium team disclosed vulnerabilities in four types of peripheral firmware -- for touchpads/trackpads, cameras, WiFi adapters, and USB hubs.

"Apple performs signature verification on all files in a driver package, including firmware, each time before they are loaded into the device, to mitigate this type of attack," the Eclypsium team said.
Click to expand...

DEVICE MAKERS FORGOT ABOUT THE EQUATION GROUP
The reason why device manufacturers aren't doing this is because of laziness, indifference, or because they don't feel they or their customers are under any threat.
However, when pressed, device makers are more than capable of enforcing strict driver/firmware signatures.

However, five years since the Equation Group's HDD implants were
found in the wild and introduced the hardware industry to the power of firmware hacking, Eclypsium says vendors have only partially addressed this problem.
Click to expand...

Knowing that the NSA was spying on their customers led many HDD and SSD vendors to improve the security of their firmware, Eclypsium said.
Click to expand...

Eclypsium: Perilous Peripherals: The Hidden Dangers Inside Windows & Linux Computers

Log in or Sign up

Five years after the Equation Group HDD hacks, firmware security still bad

guest Guest

Log in or Sign up

Five years after the Equation Group HDD hacks, firmware security still bad

guest Guest

Useful Searches