Microsoft’s aggressive push to ferret out security problems in the firmware powering IoT devices took on new urgency this week with the acquisition of ReFirm Labs, an early-stage startup that helps businesses pinpoint and fix weak links at the firmware layer.
Financial terms of the deal were not disclosed. ReFirm Labs, a four-year-old startup based in Maryland, raised $3.5 million in two rounds of early-stage venture capital funding.
According to Microsoft’s David Weston, the ReFirm Labs technology will be offered as a feature in the Azure Defender for IoT product.
The Refirm Labs deal comes exactly a year after Microsoft snapped up CyberX, an IoT security company that provides a digital map of thousands of devices scattered throughout modern organizations.
[ SEE: Microsoft: Firmware Attacks Outpacing Security Investments ]
In an interview with SecurityWeek, Weston said the two transactions fit perfectly to provide visibility and manageability to the custom operating systems and firmware that currently ship on smart light bulbs, printers and other always-connected devices.
“These two fit together perfectly,” Weston said. “For example, CyberX can determine if someone is trying to brute-force the SSH service on your device. ReFirm will tell you if that SSH service has a predictable password, whether or not it has ASLR turned on and whether or not OpenSSL actually has a CVE.”
For Microsoft, a company with a $5 billion bet on IoT, securing the layers below the operating system takes on new urgency and Weston said battle-tested Windows Update mechanism will play a key part in remediating firmware vulnerabilities.
“We took Windows Update and we’re pivoting it to IoT and the intelligent edge. So, say manufacturers get pinged by customers, they’ll have to move to a ‘Patch Tuesday’ emotion because customers can actually scan the firmware themselves.”
[ SEE: TrickBot Malware Can Scan Systems for Firmware Vulnerabilities ]
“Device builders are gonna need to come on board before they even ship it to the customer, to make sure it meets any basic security promise. And we have a device updating mechanism to keep that promise going,” Weston added.
In a statement announcing the acquisition, Microsoft said it was imperative to fix firmware security problems as billions of intelligent, cloud-connected devices flood the market and expand the available attack surface.
“You will get pwned from a vulnerability in one of these IoT devices. It’s already happening,” Weston declared.
ReFirm is well known for the Binwalk open-source software, which has been used to analyze thousands of device types for firmware security issues, uncovering unpatched common vulnerabilities and exposures (CVEs), insecure secrets, and a multitude of other security problems in plugin IoT devices and embedded firmware.
Related: Tenable Acquires OT Security Firm Indegy for $78 Million
Related: Rockwell Automation to Acquire Cybersecurity Firm Avnet
Related: Dragos Acquires NexDefense, Releases Free ICS Assessment Tools