Microsoft’s aggressive push to ferret out security problems in the firmware powering IoT devices took on new urgency this week with the acquisition of ReFirm Labs, an early-stage startup that helps businesses pinpoint and fix weak links at the firmware layer.
Financial terms of the deal were not disclosed. ReFirm Labs, a four-year-old startup based in Maryland, raised $3.5 million in two rounds of early-stage venture capital funding.
According to Microsoft’s David Weston, the ReFirm Labs technology will be offered as a feature in the Azure Defender for IoT product.
The Refirm Labs deal comes exactly a year after Microsoft snapped up CyberX, an IoT security company that provides a digital map of thousands of devices scattered throughout modern organizations.
[ SEE: Microsoft: Firmware Attacks Outpacing Security Investments ]
In an interview with SecurityWeek, Weston said the two transactions fit perfectly to provide visibility and manageability to the custom operating systems and firmware that currently ship on smart light bulbs, printers and other always-connected devices.
“These two fit together perfectly,” Weston said. “For example, CyberX can determine if someone is trying to brute-force the SSH service on your device. ReFirm will tell you if that SSH service has a predictable password, whether or not it has ASLR turned on and whether or not OpenSSL actually has a CVE.”
For Microsoft, a company with a $5 billion bet on IoT, securing the layers below the operating system takes on new urgency and Weston said battle-tested Windows Update mechanism will play a key part in remediating firmware vulnerabilities.
“We took Windows Update and we’re pivoting it to IoT and the intelligent edge. So, say manufacturers get pinged by customers, they’ll have to move to a ‘Patch Tuesday’ emotion because customers can actually scan the firmware themselves.”
[ SEE: TrickBot Malware Can Scan Systems for Firmware Vulnerabilities ]
“Device builders are gonna need to come on board before they even ship it to the customer, to make sure it meets any basic security promise. And we have a device updating mechanism to keep that promise going,” Weston added.
In a statement announcing the acquisition, Microsoft said it was imperative to fix firmware security problems as billions of intelligent, cloud-connected devices flood the market and expand the available attack surface.
“You will get pwned from a vulnerability in one of these IoT devices. It’s already happening,” Weston declared.
ReFirm is well known for the Binwalk open-source software, which has been used to analyze thousands of device types for firmware security issues, uncovering unpatched common vulnerabilities and exposures (CVEs), insecure secrets, and a multitude of other security problems in plugin IoT devices and embedded firmware.
Related: Tenable Acquires OT Security Firm Indegy for $78 Million
Related: Rockwell Automation to Acquire Cybersecurity Firm Avnet
Related: Dragos Acquires NexDefense, Releases Free ICS Assessment Tools
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- OpenSSL Ships Patch for High-Severity Flaws
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- VMware Confirms Exploit Code Released for Critical vRealize Logging Vulnerabilities
- Gem Security Gets $11 Million Seed Investment for Cloud Incident Response Platform
- Ransomware Leads to Nantucket Public Schools Shutdown
- Sentra Raises $30 Million for DSPM Technology
- Saviynt Raises $205M; Founder Rejoins as CEO
- OpenVEX Spec Adds Clarity to Supply Chain Vulnerability Warnings
Latest News
- Germany Appoints Central Bank IT Chief to Head Cybersecurity
- OpenSSL Ships Patch for High-Severity Flaws
- Software Supply Chain Security Firm Lineaje Raises $7 Million
- ICS Cybersecurity Firm Opscura Launches With $9.4 Million in Series A Funding
- Vulnerability Provided Access to Toyota Supplier Management Network
- Patch Released for Actively Exploited GoAnywhere MFT Zero-Day
- Linux Variant of Cl0p Ransomware Emerges
- VMware Says No Evidence of Zero-Day Exploitation in ESXiArgs Ransomware Attacks
