Skip to main content
168 votes
Accepted

Buying a "Used" Router

Short answer: do a factory reset, update the firmware, and you are good to go. The risk is very low, bordering zero. The previous owner may have installed a custom firmware or changed its ...
ThoriumBR's user avatar
  • 54.6k
85 votes

Should firmware images for IoT be encrypted for security reasons?

No. You should not rely upon the obscurity of your firmware in order to hide potential security vulnerabilities that exist regardless of whether or not you encrypt/obfuscate your firmware. I have a ...
Polynomial's user avatar
  • 135k
83 votes

Do multiple routers increase security?

It may look good on paper, but it's a terrible idea. You assume that the only way to get in your PC is from the first hop, the router closer to you, and that to hack one device, the previous one ...
ThoriumBR's user avatar
  • 54.6k
56 votes
Accepted

Safe to download router firmware over unencrypted HTTP?

Sure - it could be a signed image. If the router has a built-in public key, and the image was signed by the corresponding private key, it would be perfectly safe. Unless someone had got the private ...
Matthew's user avatar
  • 27.4k
29 votes

How to verify if router firmware is legitimate

There is no generic way to check if a downloaded firmware is the original one. A vendor might provide tools for this or not. But a properly designed update process would already include that the ...
Steffen Ullrich's user avatar
27 votes
Accepted

Should I worry about compromised firmware when reinstalling an OS?

Basically yes, you're right to worry. However, it's not the garden variety adversary that has that kind of capabilities... Also more and more update mechanisms are protected by a signature check, and —...
Bruno Rohée's user avatar
  • 5,507
23 votes

Safe to download router firmware over unencrypted HTTP?

It is probably safe. But downloading over https should be preferred if possible. Without https: If there is a flaw in the signature mechanism, it can be exploited (example: https://github.com/...
Tom's user avatar
  • 2,105
23 votes

Buying a "Used" Router

The main risk is that the firmware has been replaced by a malicious version, which could make it possible to intercept all the traffic on your network. Passwords, injecting malware, redirecting you to ...
schroeder's user avatar
  • 131k
18 votes

Buying a "Used" Router

By far, your main risk in buying an "open box" router is that the router has some subtle damage that the manufacturer didn't detect but that will ultimately reduce the lifespan of the device. That's ...
bta's user avatar
  • 1,131
17 votes

Can BIOS malware be installed from OS?

Firmware configuration Writing to the BIOS is a privileged operation, only doable by the superuser. Many BIOSes attempt to prevent this, for example by locking the SPI write bit and limiting the ...
forest's user avatar
  • 67k
12 votes

How can anyone access Intel's "backdoor OS", MINIX?

AMT is is hardly a secret. It is a feature for IT departments to get pseudo-console access to PCs over the network and remotely manage them. (The common term is Out of Band or OOB management.) It is ...
myron-semack's user avatar
12 votes

Is Mac OS safer to use as far as firmware rootkits, cold boot attacks and evil maid?

Are there any things like TPM and Secure boot for Mac to protect against these security problems? Short version: Yes, and recent Macs have some very good security features like hardware-based RAM ...
CBHacking's user avatar
  • 49.6k
11 votes
Accepted

Write-protection at hardware level for security

Quis custodiet ipsos custodes? Before I begin, I'd like to explain a bit about the term trust as it is used in an information security context. In infosec, trust often has the opposite meaning of what ...
forest's user avatar
  • 67k
11 votes

Should firmware images for IoT be encrypted for security reasons?

Doubtful it would be beneficial. It is by far a better option to push it open-source than closed source. It might seem silly and even controversial at first, but opening up a project to the public has ...
Josh Ross's user avatar
  • 643
9 votes
Accepted

Are DVDs vulnerable to firmware malware (and assorted questions)?

You have quite a few different questions in here. Let's try to answer them. Are DVD drives & SATA infrastructure vulnerable like badusb The SATA protocol is used exclusively for storage, not any ...
forest's user avatar
  • 67k
9 votes
Accepted

Is it possible to take an image of the firmware of HDD and SSD?

There is a standard to write firmware, the ATA DOWNLOAD_MICROCODE command and the segmented version (transfer protocol 3), but there is no standard for reading the firmware back. As another answer ...
forest's user avatar
  • 67k
8 votes

Buying a "Used" Router

In short: If you really care about stuff like that, go into a retail store and buy a new router that's on stock. The risk is small, but you can't easily mitigate it. I could imagine some creep buying ...
Nobody's user avatar
  • 703
7 votes
Accepted

Why doesn't Google publish Android firmware images with lots of drivers, which will work on lots of devices?

Why doesn't Google distribute Android firmware images with lots of included drivers, ... This means that Google would need to get access to the drivers in the first place and not only by binary but ...
Steffen Ullrich's user avatar
7 votes

What is known about the capabilities of AMD's Secure Processor?

I was interested in the same issue and did some preliminary research. I'll try to answer some of the questions, though as a non-AMD engineer I cannot be certain. Does it have software-updatable ...
laanwj's user avatar
  • 171
7 votes

Buying a "Used" Router

What are the main risks in this scenario? I know this is not the intent of your question, but in my opinion the main risk is not to you, but to the previous owner. Chances are that the credentials of ...
Sjoerd's user avatar
  • 31.8k
7 votes

Do multiple routers increase security?

It depends upon security from what? If a typical single router is compromised, then what does the compromise do? Generally this enables it to be used as a zombie attack platform that attributes back ...
user10216038's user avatar
  • 8,143
6 votes

What is the "ThinkPwn" vulnerability and what does it allow attackers to do?

what this allows an attacker to do? It allows an attacker to execute arbitrary code in System Management Mode (SMM), a highly privileged execution mode of x86 processors. This mode is transparent to ...
Ronny's user avatar
  • 1,088
6 votes

What is known about the capabilities of AMD's Secure Processor?

So what I would say is anything that provides direct memory access and essentially does processing on behalf of the processor is a whole other set of threat surfaces you are introducing to the ...
Ori's user avatar
  • 2,777
6 votes

Safe to download router firmware over unencrypted HTTP?

Probably there's a digital signature on the firmware and a key on the router. If the update file is tampered somehow, the signature verification will fail and the router will reject the update. It ...
ThoriumBR's user avatar
  • 54.6k
6 votes

Should firmware images for IoT be encrypted for security reasons?

A well-designed firmware should rely on the strength of its access key rather than relying on the attacker's ignorance of the system design. This follows the foundational security engineering ...
Mavaddat Javid's user avatar
6 votes
Accepted

Should firmware images for IoT be encrypted for security reasons?

Some people argue that code which is open source can be audited by many and therefor contains little bugs. On the other hand, attackers have the same easy access and also look for these same ...
Silver's user avatar
  • 1,820
6 votes

What are the best practices to implement secured remote firmware updates over-the-air (OTA)?

TL;DR: On your distribution system: create a public/private keypair. ship the public key with the first firmware release. create an update package. use HMAC to create a secure hash of the package. ...
ThoriumBR's user avatar
  • 54.6k
6 votes
Accepted

How can you reset a UEFI completely in case of a firmware infection?

I haven't really understood whether firmware level infection (on either motherboard or drives) can actually be a thing without physical access It's possible because you can update the firmware on ...
Austin Hemmelgarn's user avatar
6 votes

Buying a "Used" Router

If an attacker had modified the firmware in a moderately sophisticated way, then the only way to be completely sure of wiping that firmware is to update via jtag or direct flash writing. If you rely ...
jeronino's user avatar
6 votes

How to verify if router firmware is legitimate

You can check the firmware binary checksum, MD5 or hash and compare with the one published on the vendor download site. A checksum is a sequence generated after running a cryptographic hash function ...
LLub's user avatar
  • 1,246

Only top scored, non community-wiki answers of a minimum length are eligible