Component Firmware (T1542.002) is a Stealth and Persistence technique. MITRE lists Windows, Linux and macOS. Rather than the BIOS or UEFI, the adversary targets firmware in other components of the machine.
How attackers use it
MITRE explains that some adversaries use sophisticated means to compromise components and install malicious firmware, so code can run outside the operating system and main system firmware. It resembles System Firmware, but it targets devices that may not have the same capability or integrity checking.
The benefits for an attacker, as MITRE puts it: access that persists despite typical failures to maintain access and despite hard disk re-images, and a way to get past host software based defenses and integrity checks.
How to detect it
MITRE's analytics, by platform:
- Windows: anomalous driver and firmware interactions, such as unsigned or unexpected firmware updates, driver loads tied to hardware, and suspicious use of privileged APIs to read or write firmware or controller memory.
- Linux: suspicious ioctl or sysfs calls to reach device firmware, unexpected flashing tools, and odd firmware checksums reported by SMART or kernel audit.
- macOS: EFI or firmware manipulation attempts through abnormal driver loads, unsigned kexts or tampered NVRAM variables.
How to reduce the risk
MITRE lists one mitigation, Update Software: perform regular firmware updates to reduce the risk of exploitation or abuse. Keep an inventory of component firmware versions for storage, network and management controllers, and watch vendor advisories for them.
Check your own environment
On Linux, this read only command lists devices known to the firmware update service, with their versions:
fwupdmgr get-devices
Compare the result to a list of approved versions per hardware model.
Quick check
Why is component firmware attractive to an attacker?
It may have weaker integrity checking than system firmware, and malicious code there persists through disk re-images and evades host software defenses.
