Schneier on Security
NOVEMBER 18, 2019
Researchers have discovered and revealed 146 vulnerabilities in various incarnations of Android smartphone firmware. And since they're firmware bugs, in many cases there is no ability to patch them. News article. I see this as yet another demonstration of how hard supply chain security is.
Schneier on Security
JUNE 21, 2019
Triada first came to light in 2016 in articles published by Kaspersky here and here , the first of which said the malware was "one of the most advanced mobile Trojans" the security firm's analysts had ever encountered. That meant the malware could directly tamper with every installed app. This is a supply chain attack.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Schneier on Security
JULY 28, 2022
From an article : The firmware compromises the UEFI, the low-level and highly opaque chain of firmware required to boot up nearly every modern computer. Kaspersky is reporting on a new UFEI rootkit that survives reinstalling the operating system and replacing the hard drive.
Schneier on Security
SEPTEMBER 12, 2024
From a news article : The first new algorithm Microsoft added to SymCrypt is called ML-KEM. ” These algorithms are useful in very specific contexts such as firmware signing, but are not suitable for more general uses. Microsoft is updating SymCrypt , its core cryptographic library, with new quantum-secure algorithms.
SecureList
JULY 6, 2022
As a rule, this means that the source code of the device’s firmware is unavailable and all the researcher can use is the user manual and a few threads on some user forum discussing the device’s operation. The vulnerability assessment of IoT/IIoT devices is based on analyzing their firmware.
Schneier on Security
NOVEMBER 15, 2019
In particular, we discovered timing leakage on an Intel firmware-based TPM as well as a hardware TPM. Intel has a firmware update. News articles. Our analysis reveals that some of these devices feature secret-dependent execution times during signature generation based on elliptic curves. Attack website. Boing Boing post.
CSO Magazine
APRIL 28, 2021
A recent security post warned that firmware attacks are on the rise. They cited a survey of 1,000 cybersecurity decision makers at enterprises across multiple industries in the UK, US, Germany, Japan, and China finding that that 80% of firms have experienced at least one firmware attack in the past two years.
Expert insights. Personalized for you.
257 
Let's personalize your content