1

With reference to WikiLeaks new revelations on CIA firmware CherryBlossom that has been infecting Wi-Fi routers for years. How does an attacker manage to inject an unsigned firmware without being connected to the wifi?

It is feasible for an attacker if the wifi security is open. He just needs to know the known vulnerabilities in the router's firmware. But what if the wi-fi is protected? You first need to break the wi-fi password and then bypass its router's administrative password.

The wireless device itself is compromized by implanting a customized CherryBlossom firmware on it; some devices allow upgrading their firmware over a wireless link, so no physical access to the device is necessary for a successful infection. Once the new firmware on the device is flashed, the router or access point will become a so-called FlyTrap Wikileaks says

Do vendors even sign their firmware before flashing it so that only signed firmware updates can be flashed? In this way if an attacker tries to inject its own signed firmware, that will be discarded due to incorrect signature.

Sources: https://wikileaks.org/vault7/#CherryBlossom

https://arstechnica.com/security/2017/06/advanced-cia-firmware-turns-home-routers-into-covert-listening-posts/

http://securityaffairs.co/wordpress/60095/uncategorized/cia-cherry-blossom-framework.html

Improve this question

1 Answer 1

Reset to default
2

I'll tackle your second question first and then go back to the first.

No, firmware is not necessarily signed. Some vendors do, some don't.

Most hardware makers don't cryptographically sign the firmware embedded in their systems nor include authentication features in their devices that can recognize signed firmware even if they did. [1]

My guess is that, in some cases, it's a matter of cost/benefit for the manufacturers. Adding cryptographic and authentication layers for their hardware just doesn't seem like it's worth the effort, even if considered in their threat model. As you see, it takes a very sophisticated entity to pull this type of exploit. Think about a cheap WLAN card manufacturer, chances are they are not going to go above and beyond to prevent it from being attacked by an entity like the NSA.

Other hardware vendors do care. Apple for example does sign their firmware. Or hardware used in smart grid applications are usually more cryptographically secure. Again, it just depends on how far (think cost) you want to go to protect your device.

Regarding your question about wi-fi open/closed. A password protection on a wi-fi hotspot doesn't make it invulnerable. There can be numerous ways to attack it; it just depends on the type of access that you have to the router (e.g. physical, remote, etc.) and the security protocols in place. In the end it's just a matter of how hard/easy it is going to be. How many individuals actually use strong passwords for their routers and admin controls? Most people don't want to type "3Vaz8d$#2!29bcSASxL%" as their router password, for example, and opt to go for more generic ones such as "we_dem_boys_2017"

Sources and Further Reading

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .