2

The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks:

C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware.

What is the purpose of this? In what scenario does this offer protection? Is this supposed to protect against accidental installation of old firmware, of a user hacking his own device, or of an attacker installing old firmware and then exploiting a vulnerability in it? Isn't the device already totally compromised if the attacker can install old firmware?

Improve this question
1
  • I suppose one distinction is the ability to install "valid" firmware, vs arbitrary firmware. In the latter case, compromise may be immediate, since the crafted firmware could contain backdoors. – multithr3at3d Jun 23 '20 at 17:20
3

It is to prevent the exploitation of old vulnerabilities which have been fixed in newer versions.

Assume that there is a web interface which allows installation of new firmware versions and some configuration. There also is a vulnerability that allows root access to the device and full control in V1.

As responsible vendor, of course you produce V2 very fast and automatically update all devices OTA.

But if Mallory is in the internal network at your customer, he could just use the webinterface of the device to downgrade to V1, gain root access and then update back to V2.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.