Can You Trust Your Firmware?
InformationWeek is reporting that the Bureau of Industry and Security within the U. S. Commerce Department has been attacked by Chinese hackers to the point where the department is replacing hardware. Has it gotten to the point that reformatting a hard drive isn't even enough?
John Heasman's presentation at the Black Hat conference in January, 2006 described how the Advanced Configuration Power Interface could be used to comprimise a computers BIOS. In a National Public Radio piece this morning, the possiblity of comprimising a printer was discussed. "How often do you update your printer?" was asked and leads us to the more general question, what do we need to lock down?
We used to think in terms of vulnerabilities in operating systems, network services, and applications, but that may not be enough for long. It looks like we're at the point where we can't trust firmware. I suspect we will start seeing a lot more digitally signed code, including firmware, in the future.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
