Every story tagged Firmware Security, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
3 stories · open in the command center
Microsoft failed to revoke 11 defective firmware security certificates (shims) for over a decade, leaving Windows and Linux devices vulnerable to bootkit attacks that can persist across OS reinstalls and hard drive replacements. This governance failure in managing Secure Boot's complex certificate revocation system exposes organizations to sophisticated firmware-level compromise with only basic technical requirements, affecting both enterprise and consumer devices. IT leaders must immediately audit their firmware security posture, ensure all systems are patched with Microsoft's June revocation updates, and implement stronger firmware integrity monitoring to detect potential bootkit infections.
A critical vulnerability in Tesla Wall Connectors allows attackers to bypass the firmware anti-downgrade security mechanism by exploiting the order of operations during firmware updates—specifically by manipulating partition table writes before slot erasure. This vulnerability exposes charging infrastructure to unauthorized firmware downgrades that could compromise vehicle charging security, create supply chain risks for connected devices, and demonstrates that security controls implemented solely in application firmware rather than hardware-enforced mechanisms can be circumvented. IT leaders managing industrial IoT, vehicle infrastructure, or OEM partnerships must reassess their firmware update validation processes and implement hardware-backed security controls.
Google successfully integrated Rust code into the Pixel 10's cellular modem to address critical memory safety vulnerabilities that have made modems an increasingly exploited attack vector, with 18 severe vulnerabilities identified in recent years. Rather than rewriting legacy modem firmware—an impractical approach given decades of technical debt and proprietary code—Google used Rust's compile-time memory safety features to protect the DNS parser, a key point where phones process untrusted data. This incremental approach demonstrates a viable path for securing legacy embedded systems without requiring complete rewrites, though adoption may be limited by the 371KB overhead in resource-constrained devices.