Exploring EMBA: Unraveling Firmware Security with Confidence

Introduction

Firmware security analysis is a critical aspect of modern cybersecurity. As our devices become more interconnected and reliant on firmware, understanding the vulnerabilities in this often overlooked layer of software is paramount. In this article, we delve into EMBA, a powerful open-source firmware security analysis tool. We’ll explore its history, compare it to similar software projects, list its useful features, provide advice on how to effectively use EMBA, and discuss the invaluable benefits of reverse engineering firmware.

The History of EMBA

EMBA, short for “Embedded Analysis Toolkit,” was born out of the necessity to address the growing concerns regarding firmware security. It was developed by a dedicated team of security researchers including Michael Messner (penetration tester at Siemens Energy) and Pascal Eckmann (a cybersecurity engineer at Siemens AG).

They created EMBA in the vein of Metasploit, but for firmware, to raise awareness about firmware security issues with the hopes of getting them fixed. I am a big fan of this effort as I believe we still have a long way to go in the area of firmware and supply chain security of embedded systems. With the increasing number of supply chain attacks, malicious firmware, and hardware-based threats, the need for a dedicated tool to scrutinize and secure firmware became evident.

Similar Software Projects

While EMBA is a powerful and comprehensive firmware analysis tool, it’s worth mentioning some other projects in the same domain:

CHIPSEC: Developed by Intel, CHIPSEC is a platform security assessment framework. It focuses on examining the security of platform components, including firmware, hardware, and configuration.
UEFITool: UEFITool is an open-source utility designed to parse and manipulate UEFI firmware images. It’s particularly useful for analyzing and modifying BIOS/UEFI firmware.
IDA Pro: Although not exclusive to firmware analysis, IDA Pro is a widely used disassembler and debugger. It can be a valuable tool for reverse engineering firmware.
Firmadyne – Firmadyne is an open-source firmware emulation framework developed by Ivan Oprencak. It allows for the emulation of firmware, making it easier to analyze and understand its behavior. Firmadyne aids in setting up a virtual environment to execute firmware, enabling researchers to interact with the firmware without the need for the actual hardware. Firmadyne is also included in EMBA.
FACT – FACT, which stands for Firmware Analysis and Comparison Tool, emerged from a collective need to address the ever-growing concerns surrounding firmware security. It was conceived by a group of dedicated researchers, drawn from both academia and industry, who recognized the vulnerabilities lurking within the firmware of modern devices.
Various Utilities – If you’ve ever embarked on a firmware reverse engineering project you’ve likely used several different utilities that provide different information about firmware such as strings, grep, objdump, binwalk, unblob, and many others. While I believe you should learn how to use these utilities to unpack and analyze firmware, EMBA does a nice job of automating these tasks for you.

Useful Features of EMBA

EMBA boasts a wide array of features that make it an indispensable tool for firmware security analysis:

Firmware Image Analysis: EMBA can analyze firmware images extracted from various devices, such as laptops, servers, and IoT devices. The project maintains a number of different extractors that work to unpack several different types of firmware images. EMBA also supports a select set of decryption methods that are able to decrypt encrypted firmware images (which, unfortunately, has become a trend with select manufacturers).
Vulnerability Detection: It scans firmware for known vulnerabilities and issues, providing detailed reports. EMBA employs several techniques in this phase as well. The one I am fond of is version detection through emulation with Qemu, and based on the binary versions derived in this step will list associated vulnerabilities via CVE. If source code is extracted tools such as semgrep are run to detect known vulnerabilities.
Device Configuration Auditing: EMBA can extract configuration data from firmware, enabling in-depth audits of device settings. This step also includes searching for passwords and keys. If password hashes are found there is a process that will automatically perform a password dictionary attack (this is also customizable as you can specify your own password dictionaries, highly recommended).
Reverse Engineering Support: EMBA supports disassembling and analyzing firmware code, offering insights into its inner workings. I would call this a “light” check as EMBA will not automatically find vulnerabilities and write the exploits for you (perhaps in a future version? We can only hope!). EMBA does use checksec and objdump in an attempt to identify vulnerabilities that could be exploitable, but it’s BYOE (Bring Your Own Exploits).

The above list represents a small sample of EMBA features. For the full list of features, you can visit the EMBA Feature Overview page.

How to Use EMBA Effectively

Here’s some advice on how to make the most of EMBA:

Start with Documentation: Begin by thoroughly reading EMBA’s documentation to understand its functionalities and commands. (TIP: While it is recommended that you use Kali Linux as the base operating system we’ve had much better luck using Ubuntu 20.04 server).
Use decent hardware: EMBA uses dozens of tools to perform analysis, and many of them are resource intensive. For reasonably quick analysis, use a system with 8+ cores and 16GB+ RAM; it will use as many CPU cores as you give it.
Learn Firmware Basics: Familiarize yourself with firmware fundamentals, including file formats, partition layouts, and common firmware vulnerabilities.
Use Sample Images: Experiment with sample firmware images to get hands-on experience before analyzing real devices.
Collaborate and Share Knowledge: Engage with the firmware security community to seek help, share findings, and stay updated on emerging threats.
Stay Ethical: Always ensure that your firmware analysis efforts are conducted ethically and within legal boundaries.

Benefits of Reverse Engineering Firmware

Reverse engineering firmware offers numerous benefits:

Identifying Vulnerabilities: By dissecting firmware, you can discover hidden vulnerabilities and security flaws that might otherwise remain undetected. threats.
Enhancing Security: Firmware reverse engineering empowers organizations to develop patches and updates to secure their devices against potential threats.
Understanding Exploits: It helps security researchers gain insights into the techniques used by attackers to compromise firmware.
Supply Chain Assurance: Reverse engineering can reveal compromised components within the supply chain, enabling manufacturers to take corrective actions. This also hits on a concept in supply chain security that has been around for quite some time: Firmware especially will contain components that are shared by other firmware images.

Conclusion

EMBA represents a significant step forward in the realm of firmware security analysis. In a world where our reliance on interconnected devices continues to grow, understanding and securing the firmware supply chain is no longer optional. As you delve into the world of firmware security analysis, EMBA stands ready to be your trusted companion, helping you unravel the intricacies of firmware, bolster security, and protect against the ever-evolving threat landscape. Also, remember that EMBA is a tool that will assist you and requires knowledge and skill to interpret and validate results and develop exploits for discovered vulnerabilities.

Resources

The post Exploring EMBA: Unraveling Firmware Security with Confidence appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

*** This is a Security Bloggers Network syndicated blog from Eclypsium | Supply Chain Security for the Modern Enterprise authored by Paul Asadoorian. Read the original post at: https://eclypsium.com/blog/exploring-emba-unraveling-firmware-security-with-confidence/