Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [embedded-system]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
3 answers
129 views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
user avatar
  • 1,224
22 votes
6 answers
6k views

When connecting an Arduino Uno to the internet (ethernet) what are some attacks it's susceptible to and how can I secure against them?

I am connecting an Arduino Uno to the internet via ethernet (using the ethernet shield v2) and querying NTP time. Making requests to a NTP server is the only internet related thing it does. You can ...
user avatar
0 votes
1 answer
149 views

After EOL, can safety-critical systems be secured when connected to internet-connected components? [Automotive]

NOTE: This was originally asked on the main StackOverflow site, but now moved here because of the security nature of the question. Since internet-connected Infotainment Systems are now connected with ...
user avatar
  • 113
2 votes
0 answers
98 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
user avatar
0 votes
0 answers
107 views

What is a good common approach for encrypted backup/restore on an embedded device?

An embedded device with Linux supports backup/restore of files encrypted with openssl. The idea of backup is: tar -c .... | openssl smime -encrypt -binary -aes-256-cbc -out backupfile.encrypted -...
user avatar
  • 101
1 vote
1 answer
200 views

Securing IoT application

I'm designing an IoT product, I'm searching solutions to secure the system. The system's protocol is MQTT, while it's very helpful, it contains vulnerabilities. I've read enough to come with this ...
user avatar
0 votes
2 answers
135 views

How to Prevent Copying of Device Source Code in Manufacturing

Suppose you are going to mass manufacture custom circuit boards and would like the manufacturer to upload the device firmware onto these boards before shipping them out. What are some security systems/...
user avatar
2 votes
2 answers
215 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
user avatar
  • 121
0 votes
1 answer
157 views

Are weak entropy sources worth it?

I maintain an operating system that can be deployed to embedded devices with highly diverse capabilities. One of the aspects of porting the OS to a device is declaring the available entropy sources (...
user avatar
1 vote
1 answer
108 views

Security assessment of a legacy SSL/TLS implementation on an IoT device

I am doing a security assessment on the communication security of a legacy IoT device. The objective is to assess and find security gaps in the current design/implementation. The mode of assessment is ...
user avatar
1 vote
1 answer
153 views

When does it make sense to deploy an embedded firewall on my IoT device?

I have a typical IoT set up where a set of IoT devices running embedded Linux are connected to a cloud IoT server. The underlying carrier connection to the internet is over GSM. All communication to ...
user avatar
0 votes
0 answers
121 views

Addressing SSL/TLS vulnerabilities in IoT Device client side implementation

I understand SSL/TLS is the most commonly data transmission protocol for a secured communication. I need to implement the same in one of the IoT device (ARM® Cortex®-M4 Core at 80 MHz). This will be ...
user avatar
3 votes
1 answer
966 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
user avatar
3 votes
2 answers
479 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
user avatar
2 votes
0 answers
147 views

Storing a key in SRAM in an embedded device

I'm working on an embedded device which need to decrypt a file in USB stick using a secret key. I read many questions about storing a key in embedded device and found that it's secure to store a key ...
user avatar
  • 21
1 vote
1 answer
1k views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
user avatar
  • 269
4 votes
1 answer
1k views

Trusted CA SSL certificates and embedded devices

There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
user avatar
  • 141
3 votes
1 answer
734 views

Best practices to manage password for embedded Linux devices

Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
user avatar
  • 151
2 votes
4 answers
398 views

Embedded system - is it a good idea to run the user application as root?

I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?
user avatar
  • 123
3 votes
2 answers
453 views

How does a security countermeasure failure impact a system?

In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a ...
user avatar
4 votes
2 answers
203 views

Deactivate Linux Shell to prevent "blind" login on router

Today I analyzed my home router. I connected a keyboard to the router's USB port, which is usually used for mass storage devices. However, I pressed the key combination to reboot a Linux system from ...
user avatar
  • 191
0 votes
1 answer
172 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
user avatar
  • 11
1 vote
0 answers
190 views

minimum resource requirements for a TLS handshake

What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
user avatar
  • 195
4 votes
1 answer
877 views

Individual public keys for embedded devices?

I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data. The device is an embedded system which can be programmed only ...
user avatar
  • 185
0 votes
1 answer
295 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
user avatar
  • 11
2 votes
1 answer
877 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
user avatar
2 votes
0 answers
347 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
user avatar
  • 21
0 votes
1 answer
295 views

Embedded Linux: Is removing SSH alone good enough to ensure security of file system?

On my embedded Linux product, I have done the following: Disable root Remove SSH from the final product Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
user avatar
  • 259
0 votes
1 answer
411 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
user avatar
3 votes
2 answers
678 views

DRM using embedded private key

I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets. ECDSA public / private ...
user avatar
0 votes
1 answer
311 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
user avatar
  • 121
9 votes
1 answer
3k views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
user avatar
7 votes
3 answers
2k views

Hashing a large file on an embedded system

I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
user avatar
0 votes
0 answers
190 views

Why, in a certificate, TBS is before alg id?

From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
user avatar
  • 1,518
6 votes
1 answer
289 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
user avatar
  • 85
3 votes
1 answer
361 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
user avatar
  • 301
-1 votes
2 answers
1k views

What are the best practices to implement secured remote firmware updates over-the-air (OTA)?

Firmware over the air (FOTA) is a generic name for performing firmware updates remotely. Assuming that I have a microcontroller with RW memory and a bootloader, what is the best paradigm to upgrade ...
user avatar
  • 1,402
5 votes
0 answers
90 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
user avatar
  • 151
0 votes
2 answers
1k views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
user avatar
0 votes
3 answers
3k views

how to implement TLS between web-server and embedded devices

I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
user avatar
4 votes
1 answer
863 views

Sending data securely from a microcontroller to a server

I wish to transfer data securely from an arduino (a microcontroller) to a server. The obvious solution is probably to use TLS, but arduino does not have the capability to run it. I did not find ...
user avatar
  • 43
5 votes
1 answer
1k views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
user avatar
0 votes
2 answers
1k views

Pentest for Embedded Linux Device

First things that I am trying to discover using pentest: Files permissions (are sensitive files in my Linux build secure from exploits) Are programs running under users (e.g., something running under ...
user avatar
  • 215
7 votes
1 answer
2k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
user avatar
  • 215
0 votes
1 answer
741 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
user avatar
0 votes
1 answer
497 views

Code signing certificate for embedded application

Preview: I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
user avatar
0 votes
2 answers
1k views

Can Haveged help increasing entropy and make PRNG unpredictable (close to TRNG) on embedded Linux based headless device?

We have OpenSSL on BealgboneBlack Based Embedded Linux custom board and we were thinking about increasing randomness of PRNG(/dev/urandom). While browsing about it, I landed on this page: How to ...
user avatar
  • 273
2 votes
1 answer
414 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
user avatar
  • 277
5 votes
1 answer
12k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
user avatar
  • 187
-1 votes
1 answer
180 views

how to utilize openssl (already integrated with kernel) with openvpn? [closed]

the Embedded linux kernel is generated with openssl so i want to use this openssl with the other application eg. openvpn rather than compiling openssl and using it with openvpn just so that ...
user avatar