In this lesson,
we will learn about hardware and firmware attacks.
Hardware and firmware attacks exploit vulnerabilities
in the physical components or embedded software of a system.
Firmware attacks could allow attackers
to gain deep access, control, or disrupt operations
at a fundamental machine level.
Hardware and firmware attacks may be recognized
by threat actor tactics, techniques,
and procedures such as firmware tampering,
BIOS or UEFI attacks, and a USB-based attacks.
Firmware tampering attacks involve
modifying the embedded software called firmware
that controls hardware devices.
Next, BIOS and UEFI attacks specifically
target the low-level firmware
responsible for booting up a system.
Finally, USB-based attacks are compromised
or malicious USB devices
that deliver harmful code directly to a system's hardware.
Let's learn more about firmware tampering,
BIOS and UEFI attacks, and USB-based attacks.
First, we have firmware tampering.
Firmware tampering is a type of hardware
and firmware attack
where an attacker modifies the embedded firmware
on a device to control or alter its behavior.
Firmware is the low-level software
that runs on hardware components,
such as hard drives, network cards, or even smart devices,
and governs the essential functions of that hardware.
So when attackers tamper with firmware,
they gain persistent control over the hardware,
which is challenging to detect and remove,
because traditional antivirus software typically
doesn't scan the specific sections of hardware memory
where firmware code resides.
Firmware code is often stored in non-volatile memory chips,
like electrically erasable programmable read-only memory,
(EEPROM), or flash memory, embedded within devices.
Tampered firmware can then act
as a backdoor providing attackers with ongoing access
to an IT system
and allowing them to bypass security measures
at a very low and difficult-to-detect level.
An example of firmware tampering
is modifying the firmware on a network card
to monitor and intercept data packets
passing through the network interface.
In practice, attackers might use tools like Bus Pirate,
which helps communicate with and analyze hardware protocols
or Flashrom, which can reprogram firmware directly
to conduct this type of attack.
Flashrom in particular allows for reading, writing,
and erasing firmware on various chips,
making it possible for attackers to inject malicious code
into the target hardware's firmware.
Firmware tampering like this can
give attackers long-term access to sensitive data
on the network.
For the exam, it is not necessary to know the names of tools
that could be used in this type of attack
or any of them in this lesson.
This information, the names of tools,
is provided for context and example only.
So to prevent firmware tampering,
organizations should apply firmware updates
from verified sources only
and limit physical access to sensitive devices.
Additionally, implementing firmware integrity checks
and using cryptographic signatures on firmware updates
can help detect unauthorized changes.
Second, we have BIOS and UEFI attacks.
A basic input output system or BIOS
and unified extensible firmware interface
or UEFI attacks,
target the low level firmware
that controls a system's boot process.
The BIOS or UEFI is responsible for initializing
and loading an operating system,
making it a critical component of device security.
BIOS and UEFI attacks are particularly dangerous
because they take control of a system
before the operating system even loads,
which means the attacker can maintain control
over the device at a fundamental level,
even persisting through system reboots
and operating system re-installations.
To conduct an attack, an attacker could
exploit BIOS or UEFI vulnerabilities
using tools like the CH341A programmer,
which provides direct access to firmware chips
to facilitate the dumping, modifying,
and rewriting of firmware.
Attackers could also use tools like PCILeech
to gain low level access to system memory,
potentially bypassing security controls
and enabling further exploitation.
In any case, by injecting malicious code
into the BIOS or UEFI firmware,
an attacker may gain stealthy control over the system,
allowing them to intercept data
or disable security mechanisms
as soon as the device powers on.
So to prevent BIOS and UEFI attacks,
organizations should enable Secure Boot,
which ensures only signed
and trusted firmware can be loaded.
Next, regularly updating BIOS and UEFI with patches
from official manufacturers addresses known vulnerabilities.
Finally, using tamper-evident hardware
and physical security measures
can prevent unauthorized access to the hardware.
Third and last, we have USB-based attacks.
USB-based attacks exploit the physical USB connection
between a device and a system
to introduce malicious code directly into the hardware.
Attackers may use a compromised
or specially crafted USB device to launch these attacks,
allowing them to bypass traditional security defenses
like antivirus software, firewalls,
and network-based intrusion detection systems.
USB-based attacks are highly effective,
because they leverage direct physical access,
enabling code execution at a level
that can interact directly with the system's firmware
or operating system.
An example of a USB-based attack
utilizes a Rubber Ducky or BadUSB.
These tools look like standard USB drives,
but contain hidden scripts or commands
that execute immediately upon connection.
Attackers may use these devices to install key loggers,
modify system settings,
or even initiate downloads
of additional malware from remote servers.
So to prevent USB-based attacks,
organizations should implement strict policies,
prohibiting the use of unauthorized USB devices.
Next disabling autorun features on USB ports
and using USB security software
to scan and authenticate USB devices
before allowing access can mitigate these risks.
And finally, in high security environments
using data-only USB cables,
and physically blocking unused USB ports
can prevent unauthorized access.
So remember, hardware and firmware attacks
target the physical components
and embedded software of systems to gain deep control,
often at levels beyond traditional security measures.
These attacks include firmware tampering,
BIOS and UEFI attacks,
and USB-based attacks,
each leveraging different entry points
to exploit vulnerabilities.
Firmware tampering involves altering the firmware
that controls hardware components,
granting attackers persistent access to a system.
Next BIOS and UEFI attacks
target the low-level firmware responsible
for booting up a device,
allowing attackers to control the system
before the operating system even loads.
Finally, USB-based attacks are compromised USB devices
that inject malicious code directly into a system,
bypassing many conventional security defenses.