Questions tagged [embedded-system]
The embedded-system tag has no usage guidance.
87
questions
1
vote
1
answer
40
views
Do microcontroller processors like Arm Cortex-M support the TPM's Dynamic root of trust (similar to e.g. Intel TXT)?
The TPM (Trusted Platform Module) has a feature called dynamic root-of-trust. If i understand correctly a measurement of the current system is taken (to enable attestation) by the CPU and transmitted ...
- 21
0
votes
0
answers
54
views
what are the locations to store symmetric keys on the embedded controller without HSM or certs involvement?
I am trying to find the locations on the embedded devices with micros that don't support HSM/SHE. What are the ideas/suggestions for storing the symmetric keys? I found solutions that suggest using ...
1
vote
0
answers
76
views
MbedTls - keeping context private?
Let's assume we're running on mbed system with internal and external RAM. Dumping external RAM is much more easier for attacker on such systems when debug ports are locked.
I'm wondering if the ...
- 11
0
votes
1
answer
864
views
How can one use HTTPS without a domain name, or on a local network?
I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more ...
- 103
2
votes
3
answers
20k
views
Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?
The answers to Can a PDF file contain a virus? show that clearly it can!
Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
- 1,320
22
votes
6
answers
6k
views
When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?
I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
- 331
0
votes
1
answer
217
views
After EOL, can safety-critical systems be secured when connected to internet-connected components? [Automotive]
NOTE: This was originally asked on the main StackOverflow site, but now moved here because of the security nature of the question.
Since internet-connected Infotainment Systems are now connected with ...
- 113
2
votes
0
answers
162
views
IoT Device Authentication
I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/
I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
- 21
0
votes
0
answers
212
views
What is a good common approach for encrypted backup/restore on an embedded device?
An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
- 101
1
vote
1
answer
267
views
Securing IoT application
I'm designing an IoT product, I'm searching solutions to secure the system.
The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities.
I've read enough to come with this ...
- 23
0
votes
2
answers
182
views
How to Prevent Copying of Device Source Code in Manufacturing
Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
- 1
3
votes
2
answers
622
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
- 131
0
votes
1
answer
267
views
Are weak entropy sources worth it?
I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
1
vote
1
answer
172
views
Security assessment of a legacy SSL/TLS implementation on an IoT device
I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation.
The mode of assessment is ...
- 183
1
vote
1
answer
258
views
When does it make sense to deploy an embedded firewall on my IoT device?
I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
- 183
0
votes
0
answers
176
views
Addressing SSL/TLS vulnerabilities in IoT Device client side implementation
I understand SSL/TLS is the most commonly data transmission protocol for a secured communication. I need to implement the same in one of the IoT device (ARM® Cortex®-M4 Core at 80 MHz). This will be ...
- 183
4
votes
1
answer
2k
views
Self-signed certificates in embedded IoT device
I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC).
These IoT nodes would be deployed and, during ...
- 103
3
votes
2
answers
1k
views
Authentication Certificates in Embedded System (Microcontroller)
I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices.
In order to have a proper security I´m thinking about using Authentication Certificates ...
- 103
2
votes
0
answers
225
views
Storing a key in SRAM in an embedded device
I'm working on an embedded device which need to decrypt a file in USB stick using a secret key. I read many questions about storing a key in embedded device and found that it's secure to store a key ...
- 121
1
vote
1
answer
3k
views
Why authenticated boot not Secure boot?
Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
- 259
4
votes
1
answer
2k
views
Trusted CA SSL certificates and embedded devices
There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
- 141
3
votes
1
answer
2k
views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
- 151
2
votes
4
answers
810
views
Embedded system - is it a good idea to run the user application as root?
I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?
- 123
3
votes
2
answers
596
views
How does a security countermeasure failure impact a system?
In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements.
ISO26262 expresses these requirements as a ...
- 31
4
votes
2
answers
267
views
Deactivate Linux Shell to prevent "blind" login on router
Today I analyzed my home router.
I connected a keyboard to the router's USB port, which is usually used for mass storage devices.
However, I pressed the key combination to reboot a Linux system from ...
- 191
0
votes
1
answer
216
views
How can vulnerability researchers find flaws in OSes / Embedded Systems?
Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review.
How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
- 11
1
vote
0
answers
371
views
minimum resource requirements for a TLS handshake
What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
- 215
5
votes
1
answer
1k
views
Individual public keys for embedded devices?
I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data.
The device is an embedded system which can be programmed only ...
- 205
0
votes
1
answer
592
views
How applications are installed in TEE and REE
I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
- 11
2
votes
1
answer
1k
views
using secure boot in embedded systems
The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
- 277
2
votes
0
answers
466
views
GPG - Use case for embedded system
I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure.
The user will load a GPG public key onto the device. ...
- 21
0
votes
1
answer
471
views
Embedded Linux: Is removing SSH alone good enough to ensure security of file system?
On my embedded Linux product, I have done the following:
Disable root
Remove SSH from the final product
Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
- 259
0
votes
1
answer
638
views
Running Directory Traversal Against POST Request Headers [closed]
I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
- 1
3
votes
2
answers
1k
views
DRM using embedded private key
I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets.
ECDSA public / private ...
0
votes
1
answer
350
views
Security Advantages of Azure Sphere vs other embedded OS
I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
- 121
14
votes
2
answers
4k
views
TLS private key storage for embedded systems. Are there any best practices?
I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
- 361
7
votes
3
answers
3k
views
Hashing a large file on an embedded system
I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
- 71
0
votes
0
answers
225
views
Why, in a certificate, TBS is before alg id?
From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
- 1,518
6
votes
1
answer
458
views
How can I properly secure the WiFi setup process of an IoT device?
My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
- 195
3
votes
1
answer
407
views
Are MCUs (Like arduinos) effected by Meltdown?
I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
- 301
-1
votes
2
answers
2k
views
What are the best practices to implement secured remote firmware updates over-the-air (OTA)?
Firmware over the air (FOTA) is a generic name for performing firmware updates remotely.
Assuming that I have a microcontroller with RW memory and a bootloader, what is the best paradigm to upgrade ...
- 1,422
6
votes
0
answers
157
views
Is there a good way to store OAuth2 tokens for a native application?
Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
- 161
0
votes
2
answers
1k
views
HTTPS connection issue on Chrome/Chromium/Opera
I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS.
I can use Firefox or IE to make connections without any problem.
However, when ...
0
votes
3
answers
3k
views
how to implement TLS between web-server and embedded devices
I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
- 177
4
votes
1
answer
971
views
Sending data securely from a microcontroller to a server
I wish to transfer data securely from an arduino (a microcontroller) to a server.
The obvious solution is probably to use TLS, but arduino does not have the capability to run it.
I did not find ...
- 43
5
votes
1
answer
2k
views
Minimum set of TLS features for an embedded device
I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
0
votes
2
answers
2k
views
Pentest for Embedded Linux Device
First things that I am trying to discover using pentest:
Files permissions (are sensitive files in my Linux build secure from exploits)
Are programs running under users (e.g., something running under ...
- 225
8
votes
1
answer
2k
views
Security essentials for a embedded Linux device
We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
- 225
1
vote
1
answer
1k
views
How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?
ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN.
Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
- 248
0
votes
1
answer
599
views
Code signing certificate for embedded application
Preview:
I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
- 129