I have read that router firmware is supposed to be patched. How do I verify that the firmware update is indeed a unmodified version of the firmware?

I know about signature checking, but how would I do this in regards to my router?

  • 4
    Hi Bob and welcome to Security SE. I removed the last part of your question, as these are separate (and most likely already answered) questions. If necessary, you are welcome to post them separately. – Marcel Nov 29 '19 at 8:01
  • 15
    Are you asking to verify the currently installed firmware, or a firmware image before installing? – user1686 Nov 29 '19 at 12:29
  • 4
    Not sure what "I read that router firmware is supposed to be firmware patched" means – multithr3at3d Nov 29 '19 at 18:15
  • 3
    @multithr3at3d I believe he means that in order to protect your network you should keep your router's firmware up to date. – MiaoHatola Dec 1 '19 at 6:10

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the firmware is signed and that the signature is checked by the router. This does not mean that the update process for your particular system was designed as such. For specific information please refer to the vendor of the product you use.

  • 5
    The only thing really approaching a generic, OS-independent method is to find the flash TSOP/SOIC-8/etc that contains the firmware, know how its JTAG pins work, connect to it via JTAG, dump it, and compare with a known good version. – LawrenceC Nov 29 '19 at 20:54
  • Or just replace it to be sure. – mckenzm Dec 1 '19 at 9:24
  • @LawrenceC Can JTAG be spoofed by a malicious firmware? – Sevron Dec 1 '19 at 21:04
  • 2
    JTAG isn't through any firmware. It talks to the flash device directly. – LawrenceC Dec 1 '19 at 21:18
  • @mckenzm To be really sure, unplug the router from the Internet. ;-) – Michael Dec 2 '19 at 0:54

You can check the firmware binary checksum, MD5 or hash and compare with the one published on the vendor download site.

A checksum is a sequence generated after running a cryptographic hash function algorithm on a file. Calculating a checksum and comparing it with the one provided by the file source can be used as a file authenticity check method.

If you download a firmware image, you should be able to calculate that file's checksum and, if the file is authentic, the checksum should match the one provided by the source file. If the checksums don't match, it means the file was tampered with, potentially by a malicious third party attacker. Such a file is probably dangerous and shouldn't be trusted.

Vendors are providing lists of checksums for firmware files that can be downloaded from their firmware or download websites.

However here I would like to suggest yet another option ie. to install open source firmware on the router.

Average router's stock firmware is not reliable, its functionality is limited, and it is likely to be full of dangerous vulnerabilities. Vendors often do not bother to patch routers promptly with security holes. You can notice this especially when the device you are using is not the newest one. This leaves routers exposed to potential hackers automatically searching the network for security vulnerabilities to exploit.

There is yet another option to run the router on an open source firmware. Not only your router can be made safer this way, but also the open source firmware adds advanced features to your router. The open source community provides network protection and a longer shelf-life for router devices.

Most attackers will look for vulnerabilities that exist in standard routers. Open source firmware routers will have fewer vulnerabilities, are less popular and less prone to attacks.

DD-WRT open source router firmware: https://dd-wrt.com/

  • 5
    At best, referring to alternate firmware should be a comment, not an answer, because it is tangential to the question. – schroeder Nov 29 '19 at 11:00
  • 3
    If the firmware in the router is compromised, it might give you a fake checksum, or alter the one you are trying to install. Even if that one is open-source. You can’t be sure by any method that involves executing code in the device. – WGroleau Nov 30 '19 at 5:23
  • 1
    "MD5" yeah, no. That's no good. Hasn't been for like two decades. – undo Nov 30 '19 at 14:10
  • 4
    See MD5 vs SHA256 for checking file integrity discussion stackoverflow.com/q/14139727/945548 – Refineo Nov 30 '19 at 20:25

Let a be a piece of firmware.

Let aa be a version of a which I have downloaded onto my computer, and let ab be the version of a which is available at the Web site of the creator of a.

Let us assume that the creator of a has made publicly available the hash of ab.

To determine whether or not a piece of firmware is legitimate, I would compare the hash of aa and the hash of ab and discard aa if the hashes differed.

  • 3
    This is already covered in the other answers – schroeder Dec 1 '19 at 9:21
  • 1
    Also, as you've probably noticed, Information Security (and most of SE sites) don't support MathJax. – Andrew T. Dec 1 '19 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.