Microsoft Defender for IoT Gets Firmware Analysis Preview -- Redmondmag.com

Microsoft Defender for IoT Gets Firmware Analysis Preview

The firmware analysis preview will show open source software use, plus common vulnerabilities and exposures, for Internet of Things devices.

By Kurt Mackie
07/25/2023

Microsoft Defender for IoT now has a firmware analysis capability that's at the preview stage, per a Microsoft announcement this week.

The Internet of Things (IoT) firmware analysis capability aims to address the lack of transparency in IoT devices. It works by generating information from uploaded Linux-based firmware images. No agents are deployed and information on security vulnerabilities gets automatically generated.

Users of the firmware analysis capability have to upload an unencrypted image that's less than 1GB in size, per Microsoft's tutorial. "The image needs to be acquired from the device vendor," the announcement clarified.

The firmware in IoT devices is somewhat equivalent to operating systems in personal computers, Microsoft explained in this document on firmware analysis:

Just like computers have operating systems, IoT devices have firmware, and it's the firmware that runs and controls IoT devices.

However, IoT firmware has "traditionally lacked basic security measures," the document added. Worse, IoT firmware has been found to contain "hardcoded user accounts, outdated and vulnerable open-source packages, or a manufacturer's private cryptographic signing key."

Organizations using Microsoft Defender for IoT's firmware analysis preview will get a software bill of materials, which will show a list of open source software used, as well as its licensing. The firmware analysis also will show common vulnerabilities and exposures information about the firmware components. Firmware analysis will display a list of "expired and revoked TLS/SSL certificates." It'll also determine if the public and private keys used are "necessary and not accidental."

Need More IT Security Training?

On Sept. 7-8, we're hosting a two-day, virtual cybersecurity workshop for IT pros and CISOs who need to know the ins and outs of cyberinsurance so all of their infrastructure's bases are covered if (or when) disaster strikes. Register here to learn proven cybersecurity design concepts, deployment techniques and management strategies for top-tier cyberinsurance coverage.

The firmware analysis preview also checks that secure cryptographic algorithms get used for "user account password hashes." It'll provide binary hardening analysis, identifying any lack of security flags during compilation for things like "buffer overflow protection, position independent executables, and more common hardening techniques."

In essence, Internet of Things (IoT) devices are like "black boxes" for organizations in terms of security. Firmware analysis can help avoid the audit scrambles that happened with the Log4Shell attacks in late 2021, Microsoft argued. Back then, organizations were suddenly tasked with tracking Apache Log4j open source code use in various software and devices.

IoT devices also have a bad security reputation from the purported hack of an unnamed casino using an Internet-connected fish tank, widely reported back in 2017, such as this CNN report.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.