0

I bought a pair of USB flash drives made by Huawei and I want to know if there are any tools in existence for verifying that the firmware on these drives is secure. I bought them for researching this exact thing.

All of my normal web searches for trying to find this out, come back with the standard warnings not to insert a flash drive that you pick up in a parking lot - duh; but what I am asking goes much deeper.

If anyone here knows of a way to validate that the firmware in a new USB flash drive only does what it's supposed to do, I'd very much appreciate knowing about it; otherwise I guess I'll disassemble it and see what I can find out on my own.

1
  • This is a hard problem to confront directly for all the reasons stated in the answers. You can google around for tools that will help you interface with controllers on some USB sticks, but it's going to take a lot of work... trying to dump and reverse the flash will also take a lot of work... Alternatively, you could take a black-box approach and try something like attaching the USB stick to a sacrificial computer and monitor what happens... this can't really validate that the firmware "does what it is supposed to do," but on the other hand, what approach would be able to do that? – hft Jan 26 at 11:06
1

Yes, there is, but is complex and time-consuming:

  1. Open the case

  2. Use hardware probes to the pins of the NAND chip storing the firmware

  3. Take a dump of the firmware

  4. Use a disassembler or debugger to check the firmware

In the end, it depends entirely on your reverse-engineering skills. Even a good reverse-engineer can be fooled if the firmware have specific functions made to confuse or misled debugging, so your results may vary.

Instead of using the firmware to store malware, an attacker will most likely use the storage itself.

0

In 99% of the cases, the firmware is on the NAND flash. The hard part is dumping the NAND and getting some usable information out of it. If you are lucky you get a single TSOP chip, but some (and I guess the majority in the future) use BGA or are monoliths. This generally makes things more difficult. In case of multiple chips the firmware could be in any of those. Maybe the flash drive has a JTAG header or serial ports (common for NVME drives, not so much for the average flash drive) This can help you to poke around and maybe dump the memory/flash via JTAG or serial. The question is if you get a complete dump in this way. If you can get the device in bootloader mode the chance is lower that it is lying to you. There are some drives that have an SPI EEPROM but I didn't get anything usable out of it (that doesn't mean someone else can't).

In case you got the firmware you still don't know if it is "secure" or "valid". You could crosscheck if multiple drives have the same firmware. Or you need to ask the manufacturer or find some files online (usbdev.ru would be an example but you still don't know if this is original firmware) In order to check what the (original) firmware actually does you need to disassemble it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.