How to know if firmware is stealing my information?

Question

The recent news item Chinese Star N9500 Android smartphone contains factory-installed Trojan, says security firm has prompted me to think about firmware security. The news mentions the spyware is part of the device's firmware.

This makes me worry: How can I detect when firmware is stealing my information? What can I do to mitigate this problem?

I'm worried about cell phones (Android) and routers. Does someone have some information regarding detection programs?

[Edit]: Reason I ask is that I am considering a router from a China brand - which would cost much much more if it is from other brand. It is from Mi.com. The router, costs 699 RMB or 112 USD, includes a 1TB 2.5 inch hard drive. The price is very attractive, but I am worrying that my information may not be secure.

Answer 1

You could use a tool like Wireshark to analyze your outbound traffic (you need to be upstream of the device) and look for unexpected/suspicious outbound traffic. Of course, it could be infrequent or only triggered by certain activities, so you'd need a large volume of data to analyze. And you'd need to be able to analyze (at least traffic analysis) the encrypted traffic as well as plaintext.

Alternatively, you can dump the flash of your devices and reverse-engineer the firmware in the devices. Of course, you'll need to consider all the firmware:

• Cell Phone
  • Android OS & Apps
  • Bootloader
  • Baseband (GSM/LTE)
  • Bluetooth
  • Wifi Controller
• Router
  • Router OS (Linux, VxWorks, RouterOS, JunOS, iOS, etc.)
  • Wifi Controller
  • Modem (if applicable)

And don't get me started on a laptop or desktop...

So, long story short, you're talking about a project of immense proportions, something that's one of the big open questions in security. How do we trust the hardware? See all the stories about NSA implants and the questions for enterprises trying to secure their infrastructure.

Depending on your threat model, you might be able to find some things, but it's nearly impossible to be sure there's nothing unless you're making all your own chips & software.

Answer 2

The threat of firmware being compromised has been around for a decade. The entire point of doing so is to compromise a machine at a level that cannot be scanned from the operating system. It is even below the kernel level of the operating system. You would need to analyze it with an outside system to determine that the compromise was coming from the firmware. It wouldn't surprise me if the security company who analyzed the phones had to completely disassemble them to determine that the trojan had been baked into the firmware.

The only way you could actively determine if your phone was compromised without all of that was to install some form of security software (i.e. firewall and anti-virus) on your phone that would monitor and stop suspicious behavior, and then consistently monitor the logs. It might take you two or three times of setting the phone back to the factory default to determine that it has been compromised at such a deep level.

The anti-virus is also hindered by the fact that it can only stop behavior that it recognizes. If the malware installed is not known to the companies writing the software, then it won't be able to stop it. Also, the firewall wouldn't hinder any programs from contacting the internet that you have given permission to do so.

Android is currently the least secure phone operating system. Period. It is also the most targeted and exploited.

For your router and your network, the same protections apply in terms of firewalls and anti-virus, but you can also set up a packet capture system to capture sample packets of everything leaving your network. It might not stop the compromise, but you can determine what information has been compromised, what systems and ports it originated on, and proceed from there.

Answer 3

For anything other than a phone, I would argue for a less incredibly difficult, combined solution.

If it were anything but a phone, such as a router or laptop/desktop, a useful method would be to have system network logging performed by a tool at the lowest level the system permits, or even by a fake "switch" (proxy) in between the system and the router. At the same time, use a tool that captures and logs all information coming out of the router. Then, compare the two logs - what's going into the router vs what's coming out. Or, at a system level, what the system log says was going out vs what really went out (thus exposing what the firmware was hiding).

Anything the device in question is sending out that was not requested is thus suspect - and any information which changed in unexpected ways.

What makes the phone issue so much more tricky is getting upstream, or capturing all traffic incoming and outgoing, is vastly more expensive and difficult. With a wired networking device one has options, but with a phone - it's a good thing security firms are willing to put in such effort!

As to testing your desired router, however, I am aware of no simple tool or software/hardware paired solution that lets you do this all without considerable low-level knowledge and effort.

Answer 4

As can be understood by Davids excellent answer, the idea of actually verifying that the proprietary firmware of device such as a phone is not/never taking your information or capable of doing so at request is such a massive undertaking as to be nearly a ludicrous proposition.

The 'Stallman solution' would make this verification easier as source code is more humanly readable. Take a look at Tomato/OpenWRT for routers or the as yet not complete Replicant project for Android phones.

The hope of the free software/open source movements is that someone else has already done this analysis (and done it competently/completely) so you don't have to. At least the backdoors here need to be disguised as mistakes to pass the maintainer and/or team, unless he/she/them is malicious or has his/her/their machine[s] compromised.

Then you only need to worry about the hardware...