How to verify if router firmware is legitimate

Question

I have read that router firmware is supposed to be patched. How do I verify that the firmware update is indeed a unmodified version of the firmware?

I know about signature checking, but how would I do this in regards to my router?

Answer 1

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the firmware is signed and that the signature is checked by the router. This does not mean that the update process for your particular system was designed as such. For specific information please refer to the vendor of the product you use.

Answer 2

You can check the firmware binary checksum, MD5 or hash and compare with the one published on the vendor download site.

A checksum is a sequence generated after running a cryptographic hash function algorithm on a file. Calculating a checksum and comparing it with the one provided by the file source can be used as a file authenticity check method.

If you download a firmware image, you should be able to calculate that file's checksum and, if the file is authentic, the checksum should match the one provided by the source file. If the checksums don't match, it means the file was tampered with, potentially by a malicious third party attacker. Such a file is probably dangerous and shouldn't be trusted.

Vendors are providing lists of checksums for firmware files that can be downloaded from their firmware or download websites.

However here I would like to suggest yet another option ie. to install open source firmware on the router.

Average router's stock firmware is not reliable, its functionality is limited, and it is likely to be full of dangerous vulnerabilities. Vendors often do not bother to patch routers promptly with security holes. You can notice this especially when the device you are using is not the newest one. This leaves routers exposed to potential hackers automatically searching the network for security vulnerabilities to exploit.

There is yet another option to run the router on an open source firmware. Not only your router can be made safer this way, but also the open source firmware adds advanced features to your router. The open source community provides network protection and a longer shelf-life for router devices.

Most attackers will look for vulnerabilities that exist in standard routers. Open source firmware routers will have fewer vulnerabilities, are less popular and less prone to attacks.

DD-WRT open source router firmware: https://dd-wrt.com/

Answer 3

Some high-end routers support secure boot, for example:

Juniper: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/junos-os-overview.html#SecureBoot-350C8217

Cisco: https://www.cisco.com/c/en/us/products/collateral/security/cloud-access-security/secure-boot-trust.html

Answer 4

Let a be a piece of firmware.

Let a_a be a version of a which I have downloaded onto my computer, and let a_b be the version of a which is available at the Web site of the creator of a.

Let us assume that the creator of a has made publicly available the hash of a_b.

To determine whether or not a piece of firmware is legitimate, I would compare the hash of a_a and the hash of a_b and discard a_a if the hashes differed.