2

Let's say I have some USB stick that I know and trust. I can examine the firmware and generate a checksum for it.

Can I use this checksem to ensure that when the USB is next plugged in the firmware was not modified? Would it be possible to do this before and firmware ran?

Improve this question
3
  • 1
    "before firmware ran" shows that you have some huge misunderstandings. The USB firmware is not something just used to start it, it is always working.
    – deviantfan
    Commented Jul 13, 2018 at 6:24
  • 3
    And since your tool probably asks the USB itself to send the firmware data (over some vendor-specific command): What happens if the new evil firmware just doesn't send itself, but just a nice version? => No, on this way detecting anything is not possible.
    – deviantfan
    Commented Jul 13, 2018 at 6:25
  • 1
    How will you read the firmware without using the firmware on the USB stick?
    – zaph
    Commented Oct 11, 2018 at 15:36

3 Answers 3

Reset to default
1

Let's say I have some USB stick that I know and trust. I can examine the firmware and generate a checksum for it.

Can I use this checksum to ensure that when the USB is next plugged in the firmware was not modified? Would it be possible to do this before and firmware ran?

I don't see why not. Since you already have some method to examine the firmware (apparently), why not just examine the firmware again when it is next plugged in, take the checksum, and compare to the known good checksum...

This seems obvious, so maybe that this is not what you are asking about. However, if this is not what you are asking then your question is not clear to me...

Improve this answer
2
  • @MikeOunsworth what? Who? You don't mean me, do you? I haven't ever messaged you so I assume there was someone else commenting here who deleted their comments?
    – hft
    Commented Dec 11, 2018 at 1:02
  • 1
    LMAO! I'm so sorry. Yes, not you. There was an entire rant thread here that @schroeder cleaned up. It bubbled over into chat here: chat.stackexchange.com/transcript/message/47970232#47970232
    – Mike Ounsworth
    Commented Dec 11, 2018 at 1:20
1

In most cases no.

How are you reading the firmware? If via USB then surely that is going to involve interacting with the firmware. Assuming so then you cannot trust that it isn't lying to you and just returning the original while running something different.

Generally the only way to check with complete confidence is to read the contents through a side vector like soldering contacts onto the NAND the firmware is stored on and reading its contents indirectly.

Improve this answer
0

From my point of view the only way to ensure authenticity of the firmware is through asymmetric crypto, the same way used by smart cards. And ONLY after knowing that the connected device is the one you were waiting for, you will be able to trust the device to self calculate/answer the checksum and thus check the firmware integrity.

This all considering, of course, that the firmware in the device cannot be extracted in an easy manner.

Improve this answer
4
  • 1
    If the firmware has been compromised then odds are it could read any private key available to the original version.
    – Hector
    Commented Oct 11, 2018 at 14:19
  • 1
    "ensure authenticity of the firmware is through asymmetric crypto" is so vague this is not an answer.
    – zaph
    Commented Oct 11, 2018 at 15:33
  • @Hector You have a separate secure processor that verifies the firmware and signs it with its internal private key. This is how TPM attestation works to verify the BIOS on PCs.
    – user71659
    Commented Oct 11, 2018 at 20:52
  • 1
    @user71659 You're talking custom hardware - not OP's "some USB stick"
    – Hector
    Commented Oct 12, 2018 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .