Microsoft has acquired ReFirm Labs, a provider of device vulnerability management and firmware security analysis. Microsoft says the acquisition will “enrich” its firmware analysis and security capabilities across intelligent edge devices, from servers to IoT.
ReFirm Labs are the authors of the Binwalk open-source software, which has been used to analyse thousands of device types for firmware security issues, uncovering unpatched common vulnerabilities and exposures (CVEs), insecure secrets, and a multitude of other security problems in plugin IoT devices and embedded firmware. Microsoft says this technology will boost its existing IoT and operational technology (OT) security capabilities via Azure Defender for IoT.
“Device builders typically integrate third-party software and components in their solution, but they are missing the tools and the expertise in analyzing the components they consume and as a result may unknowingly ship devices with security vulnerabilities,” writes David Weston, Microsoft director of Enterprise and OS Security, in a post announcing the deal.
“This is where ReFirm Labs comes in. Microsoft believes that firmware is not a future threat, but an imperative to secure now as more devices flood the market and expand the available attack surface.”
“Together, we will provide device builders and customers the ability to both discover, protect, and assess device risk both at the firmware and network level and then patch devices with an easy-to-use cloud-based solution,”
One vertical where ReFirm Labs has found traction is telecom, where increased scrutiny and regulatory pressure is forcing companies to more carefully vet the security of the devices, such as modems and routers, that they are adding to networks. This has resulted in major customers like AT&T and Charter Communications.
The increasing demand for companies to analyse device firmware for vulnerabilities is also impacting the device manufacturers themselves.
Financial terms of the acquisition were not disclosed.
