Questions tagged [embedded-system]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
108 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
1
vote
0answers
48 views

minimum resource requirements for a TLS handshake

What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
0
votes
0answers
53 views

Using DTLS for Distributed Peer-to-Peer Communications

I'm looking to secure communications for a statically configured system. Each device is a microcontroller that has access to secret storage (TPM, etc.). There is no centralization of data for the ...
3
votes
1answer
146 views

Individual public keys for embedded devices?

I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data. The device is an embedded system which can be programmed only ...
0
votes
0answers
14 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
1
vote
1answer
286 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
2
votes
0answers
122 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
0
votes
1answer
155 views

Embedded Linux: Is removing SSH alone good enough to ensure security of file system?

On my embedded Linux product, I have done the following: Disable root Remove SSH from the final product Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
0
votes
1answer
188 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
3
votes
2answers
283 views

DRM using embedded private key

I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets. ECDSA public / private ...
0
votes
1answer
171 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
4
votes
1answer
821 views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
7
votes
3answers
548 views

Hashing a large file on an embedded system

I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
0
votes
0answers
131 views

Why, in a certificate, TBS is before alg id?

From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
4
votes
0answers
114 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
3
votes
1answer
300 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
-3
votes
3answers
573 views

What are the best practices to implement secured remote SW updates over the air (OTA)?

Firmware over the air (FOTA) is an general name for performing SW updates remotely. Assume I have a micro controller with RW memory and a boot loader. What's the right way to do SW upgrades ...
5
votes
0answers
38 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
0
votes
2answers
847 views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
0
votes
3answers
1k views

how to implement TLS between web-server and embedded devices

I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
4
votes
1answer
597 views

Sending data securely from a microcontroller to a server

I wish to transfer data securely from an arduino (a microcontroller) to a server. The obvious solution is probably to use TLS, but arduino does not have the capability to run it. I did not find ...
5
votes
1answer
391 views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
0
votes
2answers
790 views

Pentest for Embedded Linux Device

First things that I am trying to discover using pentest: Files permissions (are sensitive files in my Linux build secure from exploits) Are programs running under users (e.g., something running under ...
7
votes
1answer
965 views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
0
votes
1answer
288 views

Code signing certificate for embedded application

Preview: I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
0
votes
2answers
559 views

Can Haveged help increasing entropy and make PRNG unpredictable (close to TRNG) on embedded Linux based headless device?

We have OpenSSL on BealgboneBlack Based Embedded Linux custom board and we were thinking about increasing randomness of PRNG(/dev/urandom). While browsing about it, I landed on this page: How to ...
1
vote
1answer
237 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
2
votes
1answer
6k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
-1
votes
1answer
79 views

how to utilize openssl (already integrated with kernel) with openvpn? [closed]

the Embedded linux kernel is generated with openssl so i want to use this openssl with the other application eg. openvpn rather than compiling openssl and using it with openvpn just so that ...
1
vote
0answers
119 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
0
votes
2answers
163 views

Embedded Surveillance Devices [closed]

There is a very suspicious man living in my building. I noticed a new imbedded device at the shared entrance which he claims is a monoxide detector. As an aside, there is no need for a monoxide ...
1
vote
0answers
430 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
9
votes
1answer
3k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
0
votes
1answer
62 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
2
votes
1answer
423 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
2
votes
2answers
201 views

Way to combine encrypted tar and encrypted symmetric key with which tar was encrypted?

We are using Beaglebone Black (AM335x) based custom board, so for firmware upgrades of the board we will be using an encrypted firmware image. As you would have already guessed, we will be using ...
1
vote
1answer
744 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working on ...
3
votes
2answers
3k views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
6
votes
1answer
1k views

Does CAN bus communication need encryption?

I'm currently researching into CAN security for in-vehicle communication. I would like to know if anyone knows a reason why the CAN payloads of an ECU communication (between CAN nodes) should be ...
9
votes
2answers
4k views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
3
votes
2answers
1k views

How to handle root passwords for a number of embedded linux boxes?

Let's say I create a device which has an embedded Linux box in it (for example, a Raspberry Pi). After booting up, it starts the main application which is designed to provide the UI for the device. ...
3
votes
2answers
78 views

Guidelines for password register size in embedded devices

I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
4
votes
2answers
4k views

How to speed up slow TLS handshake on ESP8266 running mbed TLS?

I'm developing a system consisting of a mobile application and an embedded device that talk to each other. I'm using mbed TLS (formerly known as Polar SSL). The problem is that the embedded device ...
1
vote
3answers
552 views

Is a pre-set password in an embedded system secure enough?

I have a safety-critical embedded device, which sends data updates (in get requests) and pulls settings from a server. The device uses an embedded microcontroller/wifi chipset called the Particle P1; ...
2
votes
2answers
268 views

Caging unsecure internet facing IOT device

Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses. ...
10
votes
3answers
1k views

How Should WiFi Passwords be securely stored on IOT (embedded) devices?

Some devices need to store and (re)use a password (not the hash) like your mobile phone using home wifi, SmartTV, etc; How should they store the password on their flash storage? So that a person who ...
1
vote
1answer
2k views

security updates for embedded firmware Tomato (router) [closed]

I installed on my Linksys router Tomato firmware. I saw and now don't understand how security updates work. It can't be that there is no vulnerability since 2010. Tomato Firmware v1.28.1816 ...
-3
votes
3answers
125 views

Is this hypothetical system secure?

I would like to build a simple system, are there any obvious security flaws in it? Will this hashing mechanism be fairly secure without any other layers of encryption? I have a simple module where ...
0
votes
2answers
106 views

Modular security for a photography UAV?

Is modular security possible? In the context of an embedded device, is it possible to create an add-in module that will be responsible for both communications and security, with his role being ...
4
votes
3answers
379 views

How can the secret and keys be read out from the bus?

I heard that the attacks that focus on the bus between chip's blocks (e.g. between CPU and functional blocks / memory blocks) are possible. ​ The buses become the weak parts of hardware security.​ ...