Firmware

Firmware is the software embedded in an electronic device that controls its basic operation and provides the instructions it runs on.

It is low-level software held permanently in the device’s memory, responsible for initialising and managing its physical components.

It matters in security because any vulnerability in it, or any tampering with it, compromises the device at a level nothing above can correct.

What it does

Firmware acts as the bridge between the physical hardware and the higher-level software running on the device.

It loads during boot and handles the essentials: detecting hardware, initialising devices, controlling peripherals and running low-level routines.

It also holds device-specific configuration and settings that determine how the device behaves, which is why a firmware change is a behaviour change and not only a version change.

Why it matters

Firmware runs before the operating system, with more privilege than anything that starts afterwards. Code that executes at that level can survive a reinstall, and an operating system cannot reliably report on something that started before it did.

The countermeasures belong to the manufacturer as much as to the owner: signed images, verified boot, encryption where appropriate, and a route for delivering security updates that people will actually apply.

A worked example

A common case is the home or small office router.

Its firmware controls the essentials: managing the network, assigning addresses, and applying the firewall configuration.

If that firmware has a vulnerability, an attacker can use it to compromise the network, reach the devices connected to it and read what passes through. The device that is supposed to be the boundary becomes the position with the best view of everything inside it.

Firmware and firmware analysis

This entry defines the object. Firmware analysis is the activity of getting it out of the device and reading it from the inside. They are different things: one answers what it is, the other what is done to it.

Analysis starts by obtaining the image. If the manufacturer publishes the update, that is the easy route; if not, it is extracted from the hardware through a debug interface, by reading the memory chip directly, or in the worst case by removing it.

What turns up inside repeats from device to device: credentials and keys written in clear text in the filesystem, debug interfaces left enabled in production, and services that take what arrives from the network and hand it to an interpreter.

And there is a consequence that changes the severity of any finding: an extracted image applies to every device of that model. A firmware flaw does not affect one unit, it affects the whole fleet, and in many cases those are devices that do not get patched easily.

Secure boot is the countermeasure on the other side: verifying, before executing, that what is about to run is what the manufacturer signed.

Where to read more

TechTarget, Understanding firmware: what it is, what it does and the security challenges that come with it.