EFF Provides Alarm About Effects Of Firmware Malware

The discovery of malware that can modify the firmware of hard drives is a "wake up call" for manufacturers and the security industry that the risk is real and will increase the number of firmware-based attacks. Before that warns the American civil rights movement EFF. The organization argues that even if the problems are not resolved, the consequences "disastrous" can be.

Firmware is the software that runs on all kinds of computer components, such as the video card, network card and hard drive, and makes it possible to control these components. The reason for the cry of the EFF is the discovery of the Equation Group . This group of cyber spies had developed malware that could modify the firmware of all hard drives. The malware could thus reinstall or reformat survive the hard drive. Also made ​​it a hidden container for stolen files on the hard drive and was barely detect .

Firmware is next to computer components in a variety of other electronics available from auto parts to televisions. The big problem with firmware is that the code is closed. Most manufacturers make the source code of their firmware not public. In some cases, they even take steps to counter the "reverse engineer" their firmware. According to Cooper Quintin of the EFF, it is also not possible to see from the computer or the firmware of certain components has been modified or not.

Firmware-based malware is in comparison to other types of malware is still a fairly unexplored area. Attacking the firmware is not only beneficial for cyber spies, but for cybercriminals. The malware would be namely to detect and difficult to remove.Also, most firmware never publicly controlled and closed source code. Thus, according Quintin a "rich source" for zero-day vulnerabilities. Many devices the firmware is not updated, so malware or exploits for a long time may remain.

EFF urges manufacturers also to publish their firmware well as auditing for vulnerabilities and then the results. In addition, firmware updates are digitally signed and finally there should be a mechanism to check the integrity of installed firmware. "We have given up control over our computers. We trust too many different devices. Devices that we should not trust, given that they without us knowing can be compromised," said Quintin.

According to him, it is therefore high time to take control and thus to take back the security. "We need to encourage manufacturers so that they can ensure that their products are reliable, even and especially when they leave the factory floor. We must act now for a future where the foundation of our computers are safe."