According to a study by security firm Eclypsium , USB devices that users use can make their computers vulnerable to cybercriminals trying to steal their data. This is because many Linux and Windows- based peripherals come with uncertified firmware, which often opens the door to many types of attacks, including spyware , ransomware , etc. A firmware is considered uncertified when the manufacturer has not entered a validation key into it. This can allow malicious code to be inserted when downloading and installing drivers or updates from manufacturers.
According to the company's research, many trackpads, USB devices, Wi-Fi and cameras used in computers made by Dell, HP, Lenovo and other manufacturers contain such firmware. The company demonstrated its research through demonstrations, using each product from the three major companies, to show an attack that can be carried out on a server using network interface cards that contained uncertified firmware. As it turned out, once the firmware is infected on any device, it becomes impossible for any antivirus to detect the malware. Despite this, peripheral manufacturers are not adopting the introduction of certified firmware, leaving millions of Linux and Windows systems exposed.
Devices containing this firmware are vulnerable to attacks that can extract data and disrupt the operation of the affected devices, or even ransomware attacks. Such incidents are devastating to the smooth operation and security of enterprise devices, including disk drives, network cards and other peripherals.
Unfortunately, this problem cannot be fixed unless manufacturers remove the uncertified firmware. Many companies update their devices to avoid threats, but there are many that still leave their devices exposed. However, users should keep in mind that even after updating the devices, they will have to download and install the devices themselves, which is not easy. Users should check devices for uncertified firmware and drivers, as there is no solution for the problem yet. Here are the steps to check the devices:
- Go to the Windows Start menu .
- Then, search for Device Manager and run it.
- Then right-click on a device.
- Then, click the “Properties” option.
- Now, you need to go to the “Driver” tab and then you will find a tab labeled “Digital Signer”.
- There you will see whether the device is listed as uncertified or not.
- Then go to “Driver Details” and click on it. A window will appear containing a list of installed drivers for that device.
- You will see that certified devices appear with a certification icon.
