Security of firmware update mechanisms within SOHO routers

Abstract

Purpose of this thesis was to analyze the state of firmware update security within SOHO (Small Office/Home Office) routers as anecdotal claims of insecure routers are common and firmware updates are critical to the overall device security. A case study was performed, where 12 devices were analyzed using network and firmware level analysis. Analyzed devices were found to have trivial vulnerabilities where Man-In-The-Middle attacker could deny further updates or install malicious firmware through the network update mechanism. Results highlight the need for large-scale security analysis of similar devices and more secure development practices.