What is firmware?

Why are firmware updates important and how do they work?

Firmware updates consist of code that tells the hardware how to behave in a new or modified way. Firmware updates are often issued to fix bugs, prevent firmware hacks, roll out new features, improve security or interact with new media.

Some examples of what might happen following firmware updates include the following:

• A CD disc writer gains the ability to burn a new type of disk.
• A router improves its performance and stability.
• A motherboard manufacturer releases a BIOS update to support new processors.

Some internet-connected devices regularly check for new firmware and automatically download and install it. Other device manufacturers require the user to visit the manufacturer's website to download and install firmware updates manually.

The frequency of firmware updates will vary depending on the device. The firmware in a smart light bulb may not need frequent updates. However, the firmware on a smart thermostat may need to be updated periodically to remain compatible with smartphone OS updates. Smartphones commonly automate firmware upgrades alongside software updates, so the phone remains functional and users don't have to manually update firmware versions to coincide with software updates. The process of remotely updating firmware by downloading upgrades from the service provider is sometimes referred to as firmware over the air.

Many electronic devices also require that the device remains powered on while updating firmware so that the update doesn't get corrupted. Corrupting the firmware can damage some devices or cause them to malfunction. If the malfunction is permanent, the device may be damaged beyond repair. This is known as bricking, and is usually the result of damaged or deleted firmware.

Types of firmware

There are many types of firmware, but all firmware can be sorted into three categories:

• Low-level firmware. Low-level firmware is considered an intrinsic part of a device's hardware. It is often stored on non-volatile, read-only chips like ROM and cannot be rewritten or updated.
• High-level firmware. High-level firmware allows updates and is generally more complex than low-level firmware. It usually resides on flash memory chips.
• Subsystem firmware. Subsystem firmware is often part of an embedded system, such as a CPU or liquid-crystal display. Another example is a server's power subsystem, which is a piece of server hardware that functions semi-independently from the server. Like high-level firmware, subsystem firmware can be updated. Also, it is more complex than low-level firmware.

Applications of firmware

Firmware is found in a range of computing equipment, including complex devices. It is also included in devices not traditionally thought of as having computer control and in devices that are typically not considered computing devices. Some real-world applications of firmware include the following:

• Personal computer. The firmware of a personal computer -- either BIOS or unified extensible firmware interface -- comes embedded on a small memory chip on the computer's motherboard. A computer's peripherals, such as graphics and video cards, also contain firmware.
• Storage devices. USB drives, hard drives and other portable storage devices contain basic firmware that enable them to function with a computer.
• Mobile devices. Mobile phones, tablets, laptops and other mobile devices all contain firmware that let the hardware work with various software.
• Automotive. Automobiles contain many embedded systems, sensors and small computers that contain firmware that enables them to perform their designated tasks.
• Home appliances. Dishwashers and washing machines contain firmware that helps them communicate with the computer used to configure the machine's settings and control their operations.
• Smart cards. Smart cards have instructions embedded in a chip that provides the card's basic functionality, as well as authentication and encryption.

In addition to the previously listed, these devices also require firmware to operate as intended and to run user programs:

• Routers.
• Network drives.
• Printers.
• Scanners.
• Cameras.
• Industrial equipment.

Embedded firmware is a crucial element of IoT devices and networks.

The difference between firmware and software

Firmware is a type of software. However, there are several distinctions between the two.

Firmware

Firmware is software that provides basic machine instructions that allow the hardware to function and communicate with other software running on a device. Firmware provides low-level control for the various basic aspects of a specific piece of hardware, such as its startup, communication, interaction with the operating and other hardware, and so on. For this reason, it is sometimes called "software for hardware."

Another distinguishing feature is that firmware is not generally designed to be user friendly since end users usually don't interact it with directly. Also, firmware is not updated frequently. Most device manufacturers release firmware updates to address critical issues -- i.e., related to performance or security -- or to add new functionality.

Examples of firmware include BIOS and Extensible Firmware Interface.

Software

Software is designed for users to interact with a device in order to accomplish specific tasks. It sits above the firmware, is abstracted from the hardware, and uses the firmware to communicate with the underlying hardware. Software is more complex and not as bound to the underlying hardware.

A software program can usually be updated, upgraded, patched and changed out without replacing a hardware component. This is rarely possible with firmware due to its embedded nature and permanent storage on a dedicated chip within the hardware itself.

Examples of software include operating systems, as well as applications for word processing, project management, video conferencing, data processing, business intelligence and customer relationship management.

What is firmware security?

Cyberattackers and hackers can take advantage of vulnerabilities in firmware to take control of the hardware it is embedded in. They can install malware into the device, steal data and spy on users and their online activities. If the vulnerabilities are not known to the device manufacturer, exploitation may result in a zero-day attack that's almost impossible to prevent and difficult to mitigate. Also, if the hardware device is connected to other devices, say over an IoT network, these issues can spread throughout the network and exacerbate the effects of the attack.

In addition to increased vulnerability to attack, poor firmware security can also do the following:

• Erode customer confidence in the device and manufacturer.
• Weaken the manufacturer's reputation and competitive standing.
• Cause compliance-related problems (fines, legal actions) for the manufacturer.

To avoid these problems, hardware vendors need to ensure that their devices are secure by design. They must also release security patches as soon as they detect vulnerabilities to protect firmware and device users.

Firmware embedded in flash memory chips can be updated more easily than firmware written to ROM or EPROM. As flash memory plays a bigger role in the enterprise, admins must learn about the types of flash and their use cases.