Firmware is on shaky ground – let's see what it's made of

Old architectures just don't stack up

Opinion Most data theft does clear harm to the victim, and often to its customers. But while embarrassing, the cyberattack against MSI in which source code was said to be stolen is harder to diagnose. It looks like a valuable company asset that's cost a lot to develop. That its theft may be no loss is a weird idea. But then, firmware is weirder than we give it credit for. It's even hard to say exactly what it is.

That used to be easy – firmware was software built into hardware (don't mention microcode.) In the days when that meant small expensive ROM chips, only a tiny part of a device's working software could be stored that way, in general just the low-level routines that directly operated the hardware and presented APIs to software that would be loaded in later. Now many devices have enough system flash on board to hold the complete stack, firmware now includes complete operating systems and has come to mean that software at the heart of your technology that controls its behavior and which you can't just load in as an app.

This somewhat shadowy status has consequences. For a start, it has virtually no consumer market. Nobody goes out and buys new firmware; there are plenty of enthusiast alternate firmware images for any number of devices, but these are almost all free and open source. A manufacturer might sell you a feature update that's really just a firmware change, but that's rare. MSI's customers aren't buying firmware from anyone, they're getting it for free from the company itself. No illicit market exists to cream off revenues.

While companies can buy in firmware from other companies, more often, as with MSI, you're a hardware company writing your own firmware. That makes most sense; you need to develop both hardware and firmware in lockstep as both intimately influence the other. This makes most firmware too tightly linked to platforms to have any value to other businesses, except as the wrapper for trade secrets.

Even this is an illusion; your competitors are entirely capable of reverse engineering the firmware the moment it leaves your servers. Even more annoyingly, young people in hoodies can do this and make highly entertaining videos about the process. The only people really locked out by locked firmware are ordinary users.

So there's no market in stolen firmware, and not much to be gained by keeping it secret anyway. So why lock it down? There are the frequently quoted security reasons – if people could stuff any old code into the heart of their machines, who knows what evil will transpire? Only it doesn't, the experience of people who flash their Android phones with new firmware has been positive because open source communities are poor vectors of mischief. As MSI's supposed attackers claim that its private keys were stolen alongside the source code, users are at risk of fake firmware updates – but if you go anywhere except to the manufacturer when you update a motherboard, you deserve to be busted down to abacus operator.

Companies like using firmware to lock down their devices to business models – even when, as Sonos discovered, those models can provoke customer rebellion. Apple plays the same game, but more cunningly: you can't put third-party firmware into its devices, but by letting old devices die in stages after the updates stop coming, it hopes you won't notice.

But we do. We notice the old devices piling up in a desk drawer, hardware perfectly fine but with ancient firmware that just won't play with modern services. We notice that where open firmware and third-party flash images are allowed, ecosystems spring up that not only extends their lifetime, but lets them be used in entirely new ways. We notice that, far from being ridden with malware, third-party system software can keep up with security patches long after its locked-down siblings have more holes than a moth breeder's T-shirt.

So unlocking firmware makes it more secure, not less. It makes devices more useful, not less. It creates more innovation, not less. And open source firmware is theft-proof; nobody can steal what you're giving away.

There's even an argument that closed firmware only the manufacturer can update will fall foul of the right to repair laws that are flickering into existence. If your device stops working because of obsolete embedded software, how do you repair it? You could do it if you could replace the firmware like any other component, except the manufacturer is denying you the information you need to do that.

In fact, it's probably time to ditch the idea of firmware as a magical chimaera too dangerous to be freed. The idea only made sense when hardware imposed far more limits on computer architecture. Its continued existence doesn't benefit anyone – manufacturers, users, innovators or the environment. As one of the last ways left to lock people out from their own devices, it's a barrier, not a shield. Publish the code. Open the specs. There's no firm foundation for firmware any more. ®