Let's say I have some USB stick that I know and trust. I can examine the firmware and generate a checksum for it.

Can I use this checksem to ensure that when the USB is next plugged in the firmware was not modified? Would it be possible to do this before and firmware ran?

  • 1
    "before firmware ran" shows that you have some huge misunderstandings. The USB firmware is not something just used to start it, it is always working. – deviantfan Jul 13 at 6:24
  • 3
    And since your tool probably asks the USB itself to send the firmware data (over some vendor-specific command): What happens if the new evil firmware just doesn't send itself, but just a nice version? => No, on this way detecting anything is not possible. – deviantfan Jul 13 at 6:25
  • How will you read the firmware without using the firmware on the USB stick? – zaph Oct 11 at 15:36

Let's say I have some USB stick that I know and trust. I can examine the firmware and generate a checksum for it.

Can I use this checksum to ensure that when the USB is next plugged in the firmware was not modified? Would it be possible to do this before and firmware ran?

I don't see why not. Since you already have some method to examine the firmware (apparently), why not just examine the firmware again when it is next plugged in, take the checksum, and compare to the known good checksum...

This seems obvious, so maybe that this is not what you are asking about. However, if this is not what you are asking then your question is not clear to me...

  • 1
    The trick (I assume) is that you need to mount the USB device in order to check the firmware checksum, by which time the virus will have already done it's thing to the PC. – Mike Ounsworth Aug 12 at 15:17

In most cases no.

How are you reading the firmware? If via USB then surely that is going to involve interacting with the firmware. Assuming so then you cannot trust that it isn't lying to you and just returning the original while running something different.

Generally the only way to check with complete confidence is to read the contents through a side vector like soldering contacts onto the NAND the firmware is stored on and reading its contents indirectly.

From my point of view the only way to ensure authenticity of the firmware is through asymmetric crypto, the same way used by smart cards. And ONLY after knowing that the connected device is the one you were waiting for, you will be able to trust the device to self calculate/answer the checksum and thus check the firmware integrity.

This all considering, of course, that the firmware in the device cannot be extracted in an easy manner.

New contributor
Gustavo Laureano is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    If the firmware has been compromised then odds are it could read any private key available to the original version. – Hector Oct 11 at 14:19
  • "ensure authenticity of the firmware is through asymmetric crypto" is so vague this is not an answer. – zaph Oct 11 at 15:33
  • @Hector You have a separate secure processor that verifies the firmware and signs it with its internal private key. This is how TPM attestation works to verify the BIOS on PCs. – user71659 Oct 11 at 20:52
  • @user71659 You're talking custom hardware - not OP's "some USB stick" – Hector Oct 12 at 9:41

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.