Adversaries may gather information about the firmware on a victim's hosts. MITRE lists this under Reconnaissance with platform PRE. Firmware type and version can be used to infer other details such as configuration, purpose, age, and patch level.
How attackers use it
MITRE says firmware information may be obtained through direct elicitation, such as phishing for information, and may only be exposed through data sets such as job postings, network maps, assessment reports, resumes, or purchase invoices.
It can lead to more reconnaissance, to developing or obtaining capabilities, and to initial access through supply chain compromise or exploitation of a public facing application.
Firmware is often the part of the inventory nobody owns. Keeping it on the list is the first step toward knowing whether it is current.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Keep firmware inventory and update status alongside your software inventory.
- Check documents you share for model and firmware detail.
- Apply firmware updates from the vendor's own channel, and verify them where the vendor offers a way.
Quick check
What can firmware version suggest?
Configuration, purpose, age, and patch level of a host.
Where might it be exposed?
In job postings, network maps, assessment reports, resumes, and purchase invoices.
Sources
- MITRE ATT&CK, Firmware (T1592.003): https://attack.mitre.org/techniques/T1592/003
