When Firmware Modifications Attack: A Case Study of Embedded Exploitation

Ang Cui; Michael Costello; Salvatore Stolfo

When Firmware Modifications Attack: A Case Study of Embedded Exploitation
Cui, Ang
Costello, Michael
Stolfo, Salvatore
Presentations (Communicative Events)
Computer Science
Persistent URL:
Presented at the 20th Annual Network & Distributed System Security Symposium 2013
The ability to update firmware is a feature that is found in nearly all modern embedded systems. We demonstrate how this feature can be exploited to allow attackers to inject malicious firmware modifications into vulnerable embedded devices. We discuss techniques for exploiting such vulnerable functionality and the implementation of a proof of concept printer malware capable of network reconnaissance, data exfiltration and propagation to general purpose computers and other embedded device types. We present a case study of the HP-RFU (Remote Firmware Update) LaserJet printer firmware modification vulnerability, which allows arbitrary injection of malware into the printer’s firmware via standard printed documents. We show vulnerable population data gathered by continuously tracking all publicly accessible printers discovered through an exhaustive scan of IPv4 space. To show that firmware update signing is not the panacea of embedded defense, we present an analysis of known vulnerabilities found in third-party libraries in 373 LaserJet firmware images. Prior research has shown that the design flaws and vulnerabilities presented in this paper are found in other modern embedded systems. Thus, the exploitation techniques presented in this paper can be generalized to compromise other embedded systems.
Malware (Computer software)
Computer security
Computer firmware
Computer science
Item views
text | xml
Suggested Citation:
Ang Cui, Michael Costello, Salvatore Stolfo, , When Firmware Modifications Attack: A Case Study of Embedded Exploitation, Columbia University Academic Commons, .

Columbia University Libraries | Policies | FAQ