Questions tagged [embedded-system]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
4answers
127 views

Embedded system - is it a good idea to run the user application as root?

I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?
3
votes
2answers
243 views

How does a security countermeasure failure impact a system?

In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a ...
4
votes
2answers
136 views

Deactivate Linux Shell to prevent “blind” login on router

Today I analyzed my home router. I connected a keyboard to the router's USB port, which is usually used for mass storage devices. However, I pressed the key combination to reboot a Linux system from ...
0
votes
1answer
115 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
1
vote
0answers
53 views

minimum resource requirements for a TLS handshake

What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
0
votes
0answers
56 views

Using DTLS for Distributed Peer-to-Peer Communications

I'm looking to secure communications for a statically configured system. Each device is a microcontroller that has access to secret storage (TPM, etc.). There is no centralization of data for the ...
3
votes
1answer
191 views

Individual public keys for embedded devices?

I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data. The device is an embedded system which can be programmed only ...
0
votes
1answer
39 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
1
vote
1answer
378 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
2
votes
0answers
140 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
0
votes
1answer
167 views

Embedded Linux: Is removing SSH alone good enough to ensure security of file system?

On my embedded Linux product, I have done the following: Disable root Remove SSH from the final product Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
0
votes
1answer
211 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
3
votes
2answers
307 views

DRM using embedded private key

I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets. ECDSA public / private ...
0
votes
1answer
213 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
6
votes
1answer
964 views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
7
votes
3answers
627 views

Hashing a large file on an embedded system

I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
0
votes
0answers
135 views

Why, in a certificate, TBS is before alg id?

From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
4
votes
0answers
117 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
3
votes
1answer
308 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
-3
votes
3answers
626 views

What are the best practices to implement secured remote SW updates over the air (OTA)?

Firmware over the air (FOTA) is an general name for performing SW updates remotely. Assume I have a micro controller with RW memory and a boot loader. What's the right way to do SW upgrades ...
5
votes
0answers
41 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
0
votes
2answers
886 views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
0
votes
3answers
2k views

how to implement TLS between web-server and embedded devices

I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
4
votes
1answer
629 views

Sending data securely from a microcontroller to a server

I wish to transfer data securely from an arduino (a microcontroller) to a server. The obvious solution is probably to use TLS, but arduino does not have the capability to run it. I did not find ...
5
votes
1answer
414 views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
0
votes
2answers
840 views

Pentest for Embedded Linux Device

First things that I am trying to discover using pentest: Files permissions (are sensitive files in my Linux build secure from exploits) Are programs running under users (e.g., something running under ...
7
votes
1answer
1k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
0
votes
1answer
308 views

Code signing certificate for embedded application

Preview: I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
0
votes
2answers
603 views

Can Haveged help increasing entropy and make PRNG unpredictable (close to TRNG) on embedded Linux based headless device?

We have OpenSSL on BealgboneBlack Based Embedded Linux custom board and we were thinking about increasing randomness of PRNG(/dev/urandom). While browsing about it, I landed on this page: How to ...
1
vote
1answer
252 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
2
votes
1answer
7k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
-1
votes
1answer
88 views

how to utilize openssl (already integrated with kernel) with openvpn? [closed]

the Embedded linux kernel is generated with openssl so i want to use this openssl with the other application eg. openvpn rather than compiling openssl and using it with openvpn just so that ...
1
vote
0answers
120 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
0
votes
2answers
165 views

Embedded Surveillance Devices [closed]

There is a very suspicious man living in my building. I noticed a new imbedded device at the shared entrance which he claims is a monoxide detector. As an aside, there is no need for a monoxide ...
1
vote
0answers
441 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
9
votes
1answer
4k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
0
votes
1answer
64 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
2
votes
1answer
439 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
2
votes
2answers
206 views

Way to combine encrypted tar and encrypted symmetric key with which tar was encrypted?

We are using Beaglebone Black (AM335x) based custom board, so for firmware upgrades of the board we will be using an encrypted firmware image. As you would have already guessed, we will be using ...
1
vote
1answer
775 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working on ...
3
votes
2answers
3k views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
6
votes
1answer
1k views

Does CAN bus communication need encryption?

I'm currently researching into CAN security for in-vehicle communication. I would like to know if anyone knows a reason why the CAN payloads of an ECU communication (between CAN nodes) should be ...
9
votes
2answers
4k views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
3
votes
2answers
1k views

How to handle root passwords for a number of embedded linux boxes?

Let's say I create a device which has an embedded Linux box in it (for example, a Raspberry Pi). After booting up, it starts the main application which is designed to provide the UI for the device. ...
3
votes
2answers
80 views

Guidelines for password register size in embedded devices

I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
4
votes
2answers
4k views

How to speed up slow TLS handshake on ESP8266 running mbed TLS?

I'm developing a system consisting of a mobile application and an embedded device that talk to each other. I'm using mbed TLS (formerly known as Polar SSL). The problem is that the embedded device ...
1
vote
3answers
567 views

Is a pre-set password in an embedded system secure enough?

I have a safety-critical embedded device, which sends data updates (in get requests) and pulls settings from a server. The device uses an embedded microcontroller/wifi chipset called the Particle P1; ...
2
votes
2answers
269 views

Caging unsecure internet facing IOT device

Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses. ...
10
votes
3answers
2k views

How Should WiFi Passwords be securely stored on IOT (embedded) devices?

Some devices need to store and (re)use a password (not the hash) like your mobile phone using home wifi, SmartTV, etc; How should they store the password on their flash storage? So that a person who ...
1
vote
1answer
2k views

security updates for embedded firmware Tomato (router) [closed]

I installed on my Linksys router Tomato firmware. I saw and now don't understand how security updates work. It can't be that there is no vulnerability since 2010. Tomato Firmware v1.28.1816 ...