Firmware Security and Updates
Firmware Security and Updating Issues
Introduction[edit]
Due to the difficulty of this topic and the specificity of hardware and host OS firmware, this issue is generally outside the scope of Kicksecure documentation. The links provided further below may not be the most relevant to the end user, necessitating further individual research.
Firmware on Personal Computers[edit]
Firmware is generally defined as the type of software that provides control, monitoring and data manipulation of engineered products. [1] In the case of computers, firmware is held in non-volatile memory devices such as ROM, EPROM or flash memory and is associated with: [2] [3] [4] [5]
- BIOS updates.
- Non-free drivers or firmware.
- Processor microcode updates:
- On Debian systems, depending on the processor it is either the intel-microcode or amd-microcode package.
- Firmware in storage devices like harddrives, DVD drives, and flash storage.
- All computer peripherals like printers, scanners and cameras / webcams.
- UEFI compliant firmware.
- Routers and firewalls.
- Network adapters, IO controllers, power management and graphics processing units.
- 3-D graphics engines.
Firmware Updating and Security Problems[edit]
Introduction[edit]
The major problem with updating firmware is that it cannot be done automatically in most cases. Therefore, it is difficult to fix functionality or security issues after the hardware has shipped. While utility programs are often available to update BIOS, firmware in other devices is rarely updated and mechanisms for detecting and updating firmware are not standardized. [2]
If firmware can be upgraded, this is usually possible via a program created by the provider. Old firmware should always be saved before upgrading. If the process fails or the newer version performs worse, the process can be reverted. [6] Updating firmware may or may not improve security. On the one hand, it may fix vulnerabilities, but on the other hand, an update may introduce a new backdoor.
Unfortunately, most end users must blindly trust the hardware producer, so it is probably better to install non-free updates rather than risk being vulnerable to known attacks in the wild. [7] Until these re-writable firmware areas are locked down or the code is open-sourced and vastly simplified, it is likely to remain a rich environment for malicious adversaries. [8] [9]
The reality is that advanced adversaries are routinely hacking the firmware of Internet routers, switches and firewalls, along with harddrive firmware, and UEFI/EFI and ethernet adapters. The number of targets is already in the tens of thousands on an annual basis. Subverting firmware in this manner provides a stealthy and persistent presence that can eavesdrop on or re-route all network data, or access information in invisible storage areas that are unencrypted (bypassing disk encryption). Worst of all, firmware sabotage is believed to survive software updates or complete operating system re-installations. Attacks may also be designed to corrupt firmware so machines are prevented from booting, even with an external drive.
Attacks[edit]
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082025/HowManyMillionBIOSWouldYouLikeToInfect_Full2.pdf
https://www.theregister.com/2015/08/11/memory_hole_roots_intel_processors/
Supply Chain Attacks[edit]
Compromising a computing company's infrastructure is an advanced attack methodology that has risen to prominence over the last ten years: [10]
Supply chain attacks can happen when hackers gain access to a software company's infrastructure—development environment, build servers, update servers, etc.—and are able to inject malware into new software releases or security updates.
A recent example of malware that successfully targeted computer firmware is the late-2018 "Operation ShadowHammer" attack, which affected an estimated half a million Windows users utilizing ASUS hardware. In this case, the ASUS Live Update Utility -- which is responsible for automatically updating components like BIOS, UEFI, drivers, and applications -- was compromised.
It was discovered that the backdoored utility actually targeted the MAC addresses of a few hundred users, which were actually hard-coded into the trojan samples analyzed. The implication is that an advanced nation state attacker was willing to infect an untold number of innocent users for their targeted operations on a far smaller subset. [11] This sophisticated supply chain attack involved several steps: [12]
- The ASUS server which served the live update tool was compromised.
- The malicious file was signed with legitimate ASUS digital certificates so the software appeared genuine. [13] The file was actually a three-year-old binary containing harmful code.
- Users downloaded the malicious, backdoored utility through the ASUS update server.
- The trojan utility searched for targets using a set of unique MAC addresses. [14]
- Once located, a command-and-control server under the attacker's control installed additional malware on the machine.
Another relatively recent example concerns backdoors that were built into Android mobile firmware in 2017. In this case, Google researchers confirmed the advanced backdoors were preinstalled on devices before they left manufacturer factories: [15]
Triada first came to light in 2016 in articles published by Kaspersky here and here, the first of which said the malware was "one of the most advanced mobile Trojans" the security firm's analysts had ever encountered. Once installed, Triada's chief purpose was to install apps that could be used to send spam and display ads. It employed an impressive kit of tools, including rooting exploits that bypassed security protections built into Android and the means to modify the Android OS' all-powerful Zygote process. That meant the malware could directly tamper with every installed app. Triada also connected to no fewer than 17 command and control servers. In July 2017, security firm Dr. Web reported that its researchers had found Triada built into the firmware of several Android devices, including the Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20. The attackers used the backdoor to surreptitiously download and install modules. Because the backdoor was embedded into one of the OS libraries and located in the system section, it couldn't be deleted using standard methods, the report said.
This malicious Android firmware was primarily adware and focused on allowing code to be injected into the system user interface to display advertisements, the downloading and installation of applications of the attackers' choice, and encrypted communications with command and control servers. Nevertheless, it further demonstrates the weaknesses that exist in the global supply chain for various devices.
These attacks are concerning because they reveal adversaries are prepared to undermine the security underpinning the entire supply chain for their purposes, whether it is manufactured/assembled components or via breaches of trusted vendor software channels. As most users of specific computer/device hardware trust the manufacturing company, this is a very difficult problem to address, particularly since it can remain undiscovered for a long period.
In addition, this mode of attack suggests that overall improvements in computing security are forcing sophisticated attackers to "raise their game," because in general they choose the path of least resistance when attempting to infiltrate the systems of targets. [10]
For further reading on this topic, see:
Processor Microcode Updates[edit]
One recent example of a firmware vulnerability is the processor microcode update for modern chips to address speculative execution flaws. The Debian package is non-freedom software, therefore only available in the Debian "nonfree
" repository. Kicksecure recommends to avoid nonfreedom software but in this case idealism would result in insecurity.
Platform specific notice:
- A) Host operating system: Processor microcode updates should always be applied on the host operating system (for processors by Intel or AMD) [16]. [17]
- B) VMs: It is unnecessary to apply these updates in standard Kicksecure and Kicksecure inside Qubes guest VMs, as they do not have the ability to alter the microcode.
Microcode Package Check[edit]
In the following checks, the package is not installed if there is no output.
To check whether the microcode package is installed.
Debian based[edit]
On the host. Run.
dpkg -l | grep microcode
Qubes[edit]
In dom0
. Run.
dnf list | grep microcode
The Qubes check should confirm the microcode_ctl.x86_64
package is already installed. [18]
Install Microcode Package[edit]
Kicksecure
Installed by default in Kicksecure.
Other Debian Based Distributions
Intel
Install package(s) intel-microcode
following these instructions
1 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
2 Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
3 Install the intel-microcode
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends intel-microcode
4 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
5 Done.
The procedure of installing package(s) intel-microcode
is complete.
AMD
Install package(s) amd64-microcode
following these instructions
1 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
2 Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
3 Install the amd64-microcode
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends amd64-microcode
4 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
5 Done.
The procedure of installing package(s) amd64-microcode
is complete.
spectre-meltdown-checker[edit]
It is possible to check if the system is vulnerable to the Spectre and Meltdown attacks, which use flaws in modern chip design to bypass system protections.
Installation[edit]
Install package(s) spectre-meltdown-checker
following these instructions
1 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
2 Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
3 Install the spectre-meltdown-checker
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends spectre-meltdown-checker
4 Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
5 Done.
The procedure of installing package(s) spectre-meltdown-checker
is complete.
Usage[edit]
sudo spectre-meltdown-checker --paranoid ; echo $?
Forum Discussion[edit]
See: https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739
Firmware Update Manager (fwupd)[edit]
Introduction[edit]
fwupd: Is a system daemon to allow session software to update firmware. Mainly using LVFS (Linux Vendor Firmware Service) to deliver firmware updates.
LVFS: Is a centralized service where hardware vendors upload their firmware updates, which are then distributed to Linux systems using fwupd.
Debian[edit]
Installation[edit]
Install package(s) fwupd-signed
. Follow steps A to E.
A. Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
B. Install the fwupd-signed
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends fwupd-signed
C. Done.
The procedure of installing package(s) fwupd-signed
is complete.
Usage[edit]
List a summary of the security status for the firmware installed[edit]
sudo fwupdmgr security
List available firmware updates[edit]
sudo fwupdmgr get-updates
Install firmware updates[edit]
sudo fwupdmgr update
Qubes[edit]
Notes:
- The Update-Qube (appvm) for dom0 (which is most likely sys-firewall/sys-net) must have fwupd package installed [19] (it comes installed by default in full/normal template).
- To install it on Fedora minimal template:(A system restart is better to be performed after installation)
dnf install --setopt=install_weak_deps=False fwupd-qubes-vm
- There is no significant difference in usage between debian commands and qubes, just add
qubes-
tofwupdmgr
. This is--help
output:
[user@dom0 ~]$ sudo qubes-fwupdmgr --help ====================================================================== Usage: ====================================================================== Command: qubes-fwupdmgr [OPTION…][FLAG..] Example: qubes-fwupdmgr refresh --whonix --url=<url> Options: ====================================================================== get-devices: Get all devices that support firmware updates get-updates: Get the list of updates for connected hardware refresh: Refresh metadata from remote server update: Update chosen device to latest firmware version update-heads: Updates heads firmware to the latest version (EXPERIMENTAL, not fully supported yet) downgrade: Downgrade chosen device to chosen firmware version clean: Delete all cached update files Flags: ====================================================================== --whonix: Download firmware updates via Tor --device: Specify device for heads update (default - x230) --url: Address of the custom metadata remote server Help: ====================================================================== -h --help: Show help options [user@dom0 ~]$
- At the moment of writing there is not yet Qubes detailed documentation about this tool [20].
Example for command usage:
sudo qubes-fwupdmgr get-devices
sudo qubes-fwupdmgr update
Troubleshoot[edit]
You are using legacy BIOS[edit]
user@host:~$ sudo fwupdmgr security
WARNING: UEFI firmware can not be updated in legacy BIOS mode See https://github.com/fwupd/fwupd/wiki/PluginFlag:legacy-bios for more information. HSI unavailable for hypervisor user@host:~$
Your UEFI doesnt support this method of update[edit]
[user@dom0 ~]$ sudo qubes-fwupdmgr refresh
WARNING: UEFI capsule updates not available or enabled in firmware setup See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information. % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 2230 100 2230 0 0 50444 0 --:--:-- --:--:-- --:--:-- 50681 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1216k 100 1216k 0 0 20.0M 0 --:--:-- --:--:-- --:--:-- 20.1M Validating directories WARNING: UEFI capsule updates not available or enabled in firmware setup See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information. Successfully refreshed metadata manually [user@dom0 ~]$
See Also[edit]
References[edit]
- ↑ https://en.wikipedia.org/wiki/Firmware
- ↑ 2.0 2.1 https://en.wikipedia.org/wiki/Firmware#Computers
- ↑ https://en.wikipedia.org/wiki/Firmware#Other_examples
- ↑ https://www.darkreading.com/intel/raising-the-stakes-when-software-attacks-hardware
- ↑ https://www.fsf.org/campaigns/priority-projects/hardware-firmware-drivers
- ↑ https://en.wikipedia.org/wiki/Firmware#Flashing
- ↑ Also see this debian-security mailing list thread: How secure is an installation with no non-free packages?
- ↑ https://www.darkreading.com/intel/raising-the-stakes-when-software-attacks-hardware
- ↑ Mark Shuttleworth, founder of the Ubuntu Linux distribution, has described proprietary firmware as a security risk, stating "firmware on your device is the NSA's best friend" and calling firmware "a trojan horse of monumental proportions".
- ↑ 10.0 10.1 https://www.vice.com/en/article/d3y48v/what-is-a-supply-chain-attack
- ↑ https://securelist.com/operation-shadowhammer/89992/
- ↑ https://motherboard.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
- ↑ Reinforcing the notion that digital certificates are an imperfect security mechanism.
- ↑ MD5 hash values were hard-coded and found to correspond to unique MAC addresses for network adapter cards. This indicates the attackers knew the MAC addresses of their targets in advance.
- ↑ https://arstechnica.com/information-technology/2019/06/google-confirms-2017-supply-chain-attack-that-sneaked-backdoor-on-android-devices/
- ↑ ARM and POWER found to be as well affected, but less than what found in Intel and AMD.
- ↑ See: https://forums.whonix.org/t/whonix-vulerable-due-to-missing-processor-microcode-packages/5739
- ↑ This package is installed by default in Qubes to automatically protect users against hardware threats.
- ↑ https://github.com/QubesOS/qubes-issues/issues/9214#issuecomment-2105430931
- ↑ https://github.com/QubesOS/qubes-issues/issues/8813
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!