How common are firmware infections?

Question

Hard drive firmware infections were documented in 2015:

The hacking tool, believed to be a product of the NSA, is significant because subverting the firmware gives the attackers God-like control of the system in a way that is stealthy and persistent even through software updates.

You'd think that since then other malware authors would use this or similar code in less-targeted attacks, and these infections would spread. But if a firmware pandemic is around us, you don't hear much about it in the news. How common are firmware infections these days? Are there any reliable estimates?

---

(It's not unknowable: A researcher could take a random sample of machines, read their firmware and compare it to the manufacturer's images, thus obtaining an estimate of the infection rate)

Answer 1

Extremely Uncommon

One fact to consider is that we barely hear about firmware-based malware, which leaves two possible options:

1. It is extremely uncommon.
2. It is everywhere and we can't detect it.

As you yourself said, it is not impossible to see if a device has had its firmware modified. And indeed, if it were extremely common, then it would turn up in forensic analysis. We would hear quite prominently that some company has been hacked through firmware-based malware. But realistically, we don't.

Sure, as you said, there were instances of it, but they're not widespread. It's more of a proof-of-concept, or something that can be used for a high-value target. But for the common malware developer and criminal, there are so many infinitely easier options.

For instance, this guy was pwned because he was told to run a powershell snippet. I'm not picking this to make fun of the guy, but to illustrate that it's much easier to just ask someone to do something, rather than to go the extra mile and attempt to install some malicious firmware onto a device, which may risk bricking the system.

So while it is indeed possibile that this will become more important in the future, it's way more likely right now that just nobody is using this and resorting to more "low-hanging fruit".

Answer 2

Estimates? Very few on the real world, most of the cases are proof of concept, and executed on a tightly controlled environment.

A researcher could take a random sample of machines, read their firmware and compare it to the manufacturer's images, thus obtaining an estimate of the infection rate.

This is not always possible. Some devices are very secure (like CPUs, GPUs, chipsets) and extracting firmware from them aren't possible without manufacturer tools, and the manufacturer wouldn't distribute them.

Not only that, but sometimes isn't possible to determine the exact version of the installed firmware, leading to lots of false positives. Some firmwares have a version string, but not all of them. Downloading every single firmware image from a single device is a monumental task, imagine downloading all firmware images for all devices on all manufacturers.

As MeckMK1 said, there's much easier ways to compromise a device that don't need firmware hacking. From social engineering to rootkits, there are lots of avenues for data extraction and system compromise that don't demand restricted tools and knowledge, and don't lead to a bricked system if something goes wrong.