Sam Tazik here. I’ve spent years poking around embedded systems, IoT gadgets, and the guts of enterprise hardware. One pattern keeps surfacing: firmware updates are treated like an afterthought. We patch operating systems religiously. We update browsers the moment a new version drops. But the low-level code that actually runs our routers, SSDs, industrial controllers, and even smart lightbulbs? It sits there, unpatched, sometimes for years. This isn’t just a minor oversight. It’s a gaping hole in how we think about security.
Firmware is the foundational software that gives hardware its basic instructions. It lives in a shadowy space between hardware and the operating system. Because it’s out of sight, it’s out of mind. Yet firmware vulnerabilities can give an attacker persistent, nearly invisible control over a device. They can survive OS reinstalls. They can hide from antivirus. And they’re being exploited right now, often without the victim ever knowing.
The Invisible Attack Surface
Most people don’t realize how much firmware surrounds them. Your laptop’s UEFI/BIOS. The baseband processor in your phone. The microcontroller in your wireless mouse. The code running on your smart thermostat. All of it is firmware. Each of these components is a potential entry point. When a vulnerability is discovered in one of these layers, the fix isn’t a simple app store update. It requires a specialized flashing process that users rarely perform and manufacturers often fail to publicize.
Take the 2018 discovery of vulnerabilities in Supermicro server baseboard management controllers (BMCs). These tiny chips run independently of the main CPU, managing remote access and monitoring. Researchers found flaws that could let attackers gain full control over servers, even when they were powered off. Patches were issued, but adoption was spotty. Many data centers simply didn’t apply them, either because the update process was a pain or because administrators assumed the BMC was isolated enough to be safe. It wasn’t.
Why Firmware Updates Fall Through the Cracks
The neglect isn’t just laziness. It’s structural. Firmware updates are often poorly documented, inconsistently delivered, and frankly, frightening to apply. A failed OS update is annoying. A failed firmware update can brick a device permanently. That fear alone keeps IT departments and home users from touching firmware unless absolutely necessary.
Manufacturers share the blame. Many treat firmware as a one-time release, not a living codebase that needs maintenance. They ship a product, maybe push one or two updates for critical bugs, and then move on to the next hardware revision. Even when updates exist, they’re buried in support pages, wrapped in confusing flashing utilities, and accompanied by warnings that make you feel like you’re defusing a bomb.
Then there’s the visibility problem. Operating system patch status is easy to check. Firmware versions? You often need specialized tools or deep menu dives. Windows Device Manager might show a driver version, but the actual firmware on a network card or SSD is a different number entirely. Without a clear, centralized way to see what’s outdated, most people simply won’t look.
Real-World Consequences
Let’s get concrete. In 2021, security researchers demonstrated a firmware attack against Thunderbolt ports, dubbed “Thunderspy.” The vulnerability allowed an attacker with brief physical access to unlock a Thunderbolt-equipped PC, bypassing the login screen and even disk encryption. The fix required a firmware update to the Thunderbolt controller—something most users never think to check. Intel released patches, but they relied on motherboard vendors to distribute them. The chain broke. Many affected systems remain vulnerable today.
Another example: the persistent malware known as “LoJax,” discovered in 2018. It was the first documented case of a UEFI rootkit used in the wild. The attackers, a Russian-linked group, wrote malicious code directly into the motherboard’s SPI flash memory. This gave them a foothold that survived OS reinstalls and hard drive replacements. The only way to clean the infection was to reflash the firmware—a step most victims never took because they didn’t know the infection existed at that level.
Even consumer routers are a mess. A 2023 study by a German security firm found that over 60% of home routers in the EU hadn’t received a firmware update in the past two years. Many were running versions with known remote code execution flaws. These devices sit at the edge of home networks, directly exposed to the internet, yet they’re the least maintained.
The Supply Chain Blind Spot
Firmware insecurity isn’t just an endpoint problem. It’s a supply chain nightmare. When a manufacturer sources components from third parties—Wi-Fi modules, storage controllers, power management ICs—they inherit the firmware those components ship with. If the component vendor doesn’t provide a solid update mechanism, the final product inherits that weakness. This cascading dependency means a vulnerability in a single chip can affect dozens of brands across millions of devices.
The 2020 “Screaming Channels” attack illustrated this perfectly. Researchers showed that radio signals leaking from a mixed-signal chip could be used to extract AES encryption keys from firmware running on the same die. The chip was used in numerous Bluetooth and Wi-Fi products. Fixing it required firmware patches from the chipmaker, which then had to be integrated by each product vendor. The coordination was a logistical nightmare, and many devices simply never got patched.
What Should Change
The solution isn’t just “update your firmware.” That’s like telling someone to fix a leaky roof while it’s raining. We need systemic changes. First, firmware updates must become as routine and automated as OS updates. Microsoft has started pushing firmware updates through Windows Update for some Surface devices, but this should be an industry standard. Every connected device should have a secure, verified update mechanism that works without user intervention.
Second, manufacturers need to commit to long-term firmware support and make that commitment transparent at the point of sale. If a router will only receive security patches for two years, that should be on the box. Consumers and businesses can then make informed purchasing decisions, and regulators can set minimum support windows.
Third, we need better tooling. Firmware version management should be integrated into endpoint detection and response (EDR) platforms and vulnerability scanners. If a corporate laptop’s SSD firmware is three versions behind and contains a known flaw, the security team should get an alert just like they would for an unpatched OS vulnerability.
Practical Steps for the Rest of Us
While the industry sorts itself out, there are things you can do. Start by inventorying the firmware-dependent devices in your life: laptops, routers, printers, smart home gear, even your car if it’s modern enough. Check manufacturer support pages quarterly. Yes, it’s tedious. But it’s the only way to catch updates that aren’t pushed automatically.
For business environments, include firmware in your vulnerability management program. Use tools that can query firmware versions across your fleet. Some endpoint management suites now offer this capability, though coverage is still spotty. When evaluating new hardware, ask vendors about their firmware update policy. If they can’t give you a clear answer, consider that a red flag.
On the development side, if you’re building products that include firmware, design the update process from day one. Use signed updates, implement rollback protection, and test the update mechanism as rigorously as the primary functionality. Make firmware updates easy for your customers, not an afterthought buried in a PDF manual.
FAQ
Why are firmware updates often ignored compared to software updates?
Firmware updates are typically harder to discover, more complex to apply, and carry a higher risk of permanently damaging the device if something goes wrong. Unlike software updates that can be rolled back or reinstalled, a failed firmware flash can render hardware unusable. Additionally, manufacturers rarely promote firmware updates with the same urgency as OS or application patches, leaving users unaware of critical fixes.
How can I check if my devices need firmware updates?
For most consumer devices, you’ll need to visit the manufacturer’s support website and look up your specific model. Some devices, like modern routers, have a built-in check feature in their administration interface. For PC components, utilities like Intel’s Driver & Support Assistant or your motherboard vendor’s software can help. In enterprise environments, consider deploying specialized firmware scanning tools that integrate with your existing security stack.
What makes firmware attacks so dangerous compared to regular malware?
Firmware attacks operate below the operating system level, making them extremely difficult to detect with traditional antivirus or endpoint protection. They can persist through OS reinstalls, hard drive replacements, and even device wipes. Once an attacker gains firmware-level access, they can maintain long-term control over the device, intercept data before it reaches the OS, and potentially spread to other components on the same hardware bus.
Are firmware attacks common in the real world?
While not as frequent as phishing or ransomware, firmware attacks are a growing concern. High-profile examples like LoJax, ThunderSpy, and various BMC exploits demonstrate that sophisticated attackers—particularly nation-state groups—actively target firmware. The 2020 “Screaming Channels” research also showed that firmware vulnerabilities can exist in widely used components, affecting millions of devices. As firmware security receives more attention, both attacks and defenses will likely increase.
Firmware security isn’t glamorous. It doesn’t make headlines like a new zero-day in Chrome. But it’s the kind of problem that, left unchecked, undermines everything else we do to stay safe. The next time you’re patching your servers and updating your endpoints, take a moment to check the firmware too. It might just save you from an attack you’ll never see coming.
