{"id":7228,"date":"2023-07-27T21:43:20","date_gmt":"2023-07-27T19:43:20","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=7228"},"modified":"2023-07-28T22:53:17","modified_gmt":"2023-07-28T20:53:17","slug":"how-to-use-defender-for-iot-firmware-scanning-for-checking-potential-security-vulnerabilities-and-weaknesses","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/how-to-use-defender-for-iot-firmware-scanning-for-checking-potential-security-vulnerabilities-and-weaknesses\/","title":{"rendered":"How to use Defender for IoT\u00a0firmware Scanning for checking potential security vulnerabilities and weaknesses"},"content":{"rendered":"\n

Recently Microsoft announced a new firmware scanning feature in Defender for IoT. With the new Defender for IoT Firmware analysis, it is possible to upload firmware images for security analysis and checking against vulnerabilities and weaknesses. <\/p>\n\n\n\n

Currently, the feature is released in public preview. The Defender for IoT Firmware Analysis feature is automatically available when the Defender for IoT is opened via the Security Admin, Contributor, or Owner role. More information related to the permission model is explained in this blog. <\/p>\n\n\n\n

This new tool comes from the Refirm Labs acquisition<\/a> and is now integrated into the Defender for IoT stack. Let’s explore this new feature more in-depth. <\/p>\n\n\n\n

<\/p>\n\n\n\n

Blog information:
<\/strong>
<\/strong>Blog published: July 27, 2023
Blog latest updated: July 27, 2023<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Defender for IoT Firmware Analysis<\/h2>\n\n\n\n

Defender for IoT Firmware analysis is a new feature included in the Defender for IoT portal. With the new feature, it is possible to get visibility into the vulnerability posture of devices. This feature is really useful since there is no need to deploy anything, there is no Defender for IoT agent required or additional tooling for scanning the firmware. This is especially interesting for appliance-level devices where you can\u2019t install EDR toolings\/ IoT sensors or a vulnerability scanning agent. <\/p>\n\n\n\n

Compared with network traffic analysis, the firmware analysis gives more in-depth results. This feature is useful when you build the firmware in-house or receive firmware from the supply chain – before it was difficult to review the firmware and check for potentially known vulnerabilities. Based on recent attacks; never trust the vendor or supply chain. And even when developing firmware by internal teams it is good to run additional checks against known weaknesses and vulnerabilities. <\/p>\n\n\n\n

Modern solutions and black box for IoT\/ OT devices<\/strong><\/h3>\n\n\n\n

With modern endpoint solutions, Defender for IoT capabilities, and EDR solutions, IT and security analysts can get visibility into the software inventories and vulnerabilities. A good example is Defender for Endpoint where the Threat Vulnerability Management gives a broad view of the threat scope for application\/ drivers and hardware components. <\/p>\n\n\n\n

For IoT and OT devices without an agent, it is more of a black box, without full in-depth insights into the known vulnerabilities and potential anomalies around the firmware. Good examples are vulnerable open-source packages\/ hardcoded user accounts or manufacturers’ private signing keys. <\/p>\n\n\n\n

How works the Firmware Analysis<\/strong><\/h3>\n\n\n\n

The new Defender for IoT Firmware Analysis runs the analysis based on the uploaded binary firmware images. For running the analysis there is no additional agent needed.<\/p>\n\n\n\n

The firmware image must have the following prerequisites:<\/p>\n\n\n\n