const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/FIRMWARE" date="2026-08-12" title="Unsigned updates are the incident waiting to happen" lede="If the box will install a tarball over HTTP because a checkbox in the UI said so, the rest of the binary review is commentary. Say that first."/>
<P>We still get images where the updater is <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>wget</span> plus <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>tar -x</span> plus reboot. Sometimes there is an HMAC with the key in the same filesystem. Sometimes there is a signature check that the debug build compiled out. This is not subtle. It is also the finding CISOs understand.</P>
<Callout>We describe the path in the image. We do not publish a recipe for pushing a malicious image at a stranger’s device.</Callout>
<H2>What “signed” has to mean</H2>
<Ul items={[
'A public key in ROM or in a write-protected partition — not only in squashfs next to the updater.',
'A check that runs before flash, not a log line after.',
'A failure that refuses to boot the new image, not a warning in dmesg.',
'A documented way to rotate the key. If there is none, write that.'
]}/>
<H3>HMAC with a shipped key</H3>
<P>That is a checksum with extra steps. Anyone who unpacked the image has the key. Report it as “integrity, not authenticity.” Do not call it secure boot.</P>
<H3>HTTPS to a vendor CDN</H3>
<P>Transport is not image signing. A stolen CDN path still installs. If the only control is TLS to a hostname, say “transport only.”</P>
<H3>Secure boot theater</H3>
<P>Verified boot on the kernel and an unsigned overlay for “app.” The overlay is the product. We have seen this. The report names which hop is verified. See <a href="post-fw-boot.html">the boot chain</a>.</P>
<H2>Where we look</H2>
<Code lang="sh">{`grep -RInE 'fw_upgrade|sysupgrade|do_upgrade|mtd write' squashfs-root
# then Ghidra on that binary: does it call a verify() before flash?
# strings: BEGIN PUBLIC KEY, HMAC, openssl`}</Code>
<P>If we cannot find a verify, we do not invent one. “No signature check found in the updater” is a complete sentence. Confirm with the vendor if they claim otherwise — they sometimes have a second updater not in this SKU.</P>
<H2>What we do not do</H2>
<P>We do not build a replacement image for the public internet. In a lab named in the letter, we may install a benign marker image to show the check is absent. That demonstration stays in the report. It is not a module.</P>
<Related items={[
['post-fw-boot.html','The boot chain is the map'],
['post-fw-config.html','The finding is often in /etc'],
['post-firmware.html','Unpacking firmware']
]}/>
</>;
}
window.Article=Article;
mountPost();