Firmware is typically built upon many software components assembled together to achieve the desired functionality of the product being made. Market pressures to release products quickly have forced firmware developers to rely on existing Free Open Source Software (FOSS) to reduce their time to market. However, firmware developers rarely consider the potential vulnerabilities being introduced by using outdated and un-patched software components.
Today ReFirm Labs is excited to announce a new feature available to all platform subscribers. Software Bill of Materials powered by Centrifuge™ will generate a list of open source components that are present in a firmware image by comparing the files found within the firmware and matching them up with components. This allows our customers to know the exact components that were used when the firmware was developed and to pinpoint any potential risks by comparing those components with Guardian results.
This feature is a big first step towards being able to provide a scalable and automated way for our customers achieve software component transparency for their firmware images. As you may know the security industry is currently working toward requiring manufacturers to provide a Software BOM with all of their product sales (to learn more about this issue and how it can help prevent attacks against firmware and other products see the NTIA’s Software Transparency working group page: https://www.ntia.doc.gov/SoftwareTransparency). However these efforts are likely years away from being ratified by all the major device manufacturers and will only be available for new products and products still under a support contract. The Centrifuge™ Software BOM feature is available for all of our supported firmware types and is ready to use today!
In the coming months we will be adding support to identify the component version, and then being able to correlate that data with our Guardian results! Stay tuned for more progress on this feature!
Interested in trying out the Software BOM feature for yourself? Request a Free Trial!