From InfoWorld: A team of security researchers has found serious vulnerabilities in over a dozen wireless routers and access points from Netgear and D-Link with the help of an open-source framework that can be used to perform dynamic security analysis on embedded firmware.
Called Firmadyne, the framework automatically runs Linux-based firmware designed for embedded devices in an emulated environment and then performs a variety of security tests, including checks on known exploits that exist in penetration testing tools.
The framework was built by Daming Chen, Maverick Woo and David Brumley from Carnegie Mellon University and Manuel Egele from Boston University. It was released last week as an open source project along with an accompanying research paper.
The researchers used Firmadyne on a collection of around 23,000 firmware images collected from 42 embedded device manufacturers. The framework was able to extract 9,486 of those images and found that 887 of them were vulnerable to at least one of 74 known exploits. Furthermore, the researchers were able to find 14 previously unknown vulnerabilities in 69 firmware images used by 12 products.
View: Article @ Source Site
