29

I have read that router firmware is supposed to be patched. How do I verify that the firmware update is indeed a unmodified version of the firmware?

I know about signature checking, but how would I do this in regards to my router?

4
  • 4
    Hi Bob and welcome to Security SE. I removed the last part of your question, as these are separate (and most likely already answered) questions. If necessary, you are welcome to post them separately.
    – Marcel
    Nov 29, 2019 at 8:01
  • 15
    Are you asking to verify the currently installed firmware, or a firmware image before installing?
    – user1686
    Nov 29, 2019 at 12:29
  • 4
    Not sure what "I read that router firmware is supposed to be firmware patched" means Nov 29, 2019 at 18:15
  • 3
    @multithr3at3d I believe he means that in order to protect your network you should keep your router's firmware up to date.
    – MiaoHatola
    Dec 1, 2019 at 6:10

4 Answers 4

30

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the firmware is signed and that the signature is checked by the router. This does not mean that the update process for your particular system was designed as such. For specific information please refer to the vendor of the product you use.

5
  • 5
    The only thing really approaching a generic, OS-independent method is to find the flash TSOP/SOIC-8/etc that contains the firmware, know how its JTAG pins work, connect to it via JTAG, dump it, and compare with a known good version.
    – LawrenceC
    Nov 29, 2019 at 20:54
  • Or just replace it to be sure.
    – mckenzm
    Dec 1, 2019 at 9:24
  • @LawrenceC Can JTAG be spoofed by a malicious firmware?
    – Sevron
    Dec 1, 2019 at 21:04
  • 2
    JTAG isn't through any firmware. It talks to the flash device directly.
    – LawrenceC
    Dec 1, 2019 at 21:18
  • @mckenzm To be really sure, unplug the router from the Internet. ;-)
    – Michael
    Dec 2, 2019 at 0:54
6

You can check the firmware binary checksum, MD5 or hash and compare with the one published on the vendor download site.

A checksum is a sequence generated after running a cryptographic hash function algorithm on a file. Calculating a checksum and comparing it with the one provided by the file source can be used as a file authenticity check method.

If you download a firmware image, you should be able to calculate that file's checksum and, if the file is authentic, the checksum should match the one provided by the source file. If the checksums don't match, it means the file was tampered with, potentially by a malicious third party attacker. Such a file is probably dangerous and shouldn't be trusted.

Vendors are providing lists of checksums for firmware files that can be downloaded from their firmware or download websites.

However here I would like to suggest yet another option ie. to install open source firmware on the router.

Average router's stock firmware is not reliable, its functionality is limited, and it is likely to be full of dangerous vulnerabilities. Vendors often do not bother to patch routers promptly with security holes. You can notice this especially when the device you are using is not the newest one. This leaves routers exposed to potential hackers automatically searching the network for security vulnerabilities to exploit.

There is yet another option to run the router on an open source firmware. Not only your router can be made safer this way, but also the open source firmware adds advanced features to your router. The open source community provides network protection and a longer shelf-life for router devices.

Most attackers will look for vulnerabilities that exist in standard routers. Open source firmware routers will have fewer vulnerabilities, are less popular and less prone to attacks.

DD-WRT open source router firmware: https://dd-wrt.com/

4
  • 5
    At best, referring to alternate firmware should be a comment, not an answer, because it is tangential to the question.
    – schroeder
    Nov 29, 2019 at 11:00
  • 3
    If the firmware in the router is compromised, it might give you a fake checksum, or alter the one you are trying to install. Even if that one is open-source. You can’t be sure by any method that involves executing code in the device.
    – WGroleau
    Nov 30, 2019 at 5:23
  • 1
    "MD5" yeah, no. That's no good. Hasn't been for like two decades.
    – undo
    Nov 30, 2019 at 14:10
  • 4
    See MD5 vs SHA256 for checking file integrity discussion stackoverflow.com/q/14139727/945548
    – LLub
    Nov 30, 2019 at 20:25
0

Let a be a piece of firmware.

Let aa be a version of a which I have downloaded onto my computer, and let ab be the version of a which is available at the Web site of the creator of a.

Let us assume that the creator of a has made publicly available the hash of ab.

To determine whether or not a piece of firmware is legitimate, I would compare the hash of aa and the hash of ab and discard aa if the hashes differed.

2
  • 3
    This is already covered in the other answers
    – schroeder
    Dec 1, 2019 at 9:21
  • 1
    Also, as you've probably noticed, Information Security (and most of SE sites) don't support MathJax.
    – Andrew T.
    Dec 1, 2019 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.