Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [embedded-system]

The tag has no usage guidance.

1
vote
1answer
77 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
2
votes
0answers
70 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
0
votes
1answer
126 views

Embedded Linux: Is removing SSH alone good enough to ensure security of file system?

On my embedded Linux product, I have done the following: Disable root Remove SSH from the final product Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
0
votes
1answer
123 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
3
votes
2answers
173 views

DRM using embedded private key

I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets. ECDSA public / private ...
0
votes
1answer
131 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
4
votes
1answer
361 views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
0
votes
0answers
36 views

Run Single User Mode with Secure Boot active

I am investigating an embedded system using a Linux Kernel, with UEFI, Secure Boot enabled and no bootloader (e.g. LILO, Grub...). Could I somehow boot the device into Single User Mode? I think Secure ...
7
votes
3answers
239 views

Hashing a large file on an embedded system

I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
0
votes
0answers
117 views

Why, in a certificate, TBS is before alg id?

From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
3
votes
0answers
89 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
3
votes
1answer
281 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
-4
votes
3answers
438 views

What are the best practices to implement secured remote SW updates over the air (OTA)?

Firmware over the air (FOTA) is an general name for performing SW updates remotely. Assume I have a micro controller with RW memory and a boot loader. What's the right way to do SW upgrades ...
5
votes
0answers
28 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
0
votes
2answers
681 views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
0
votes
3answers
883 views

how to implement TLS between web-server and embedded devices

I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
3
votes
1answer
429 views

Sending data securely from a microcontroller to a server

I wish to transfer data securely from an arduino (a microcontroller) to a server. The obvious solution is probably to use TLS, but arduino does not have the capability to run it. I did not find ...
5
votes
1answer
298 views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
0
votes
2answers
631 views

Pentest for Embedded Linux Device

First things that I am trying to discover using pentest: Files permissions (are sensitive files in my Linux build secure from exploits) Are programs running under users (e.g., something running under ...
6
votes
1answer
702 views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
0
votes
1answer
220 views

Code signing certificate for embedded application

Preview: I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
0
votes
2answers
399 views

Can Haveged help increasing entropy and make PRNG unpredictable (close to TRNG) on embedded Linux based headless device?

We have OpenSSL on BealgboneBlack Based Embedded Linux custom board and we were thinking about increasing randomness of PRNG(/dev/urandom). While browsing about it, I landed on this page: How to ...
1
vote
1answer
179 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
2
votes
1answer
5k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
-1
votes
1answer
56 views

how to utilize openssl (already integrated with kernel) with openvpn? [closed]

the Embedded linux kernel is generated with openssl so i want to use this openssl with the other application eg. openvpn rather than compiling openssl and using it with openvpn just so that ...
1
vote
0answers
102 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
0
votes
2answers
154 views

Embedded Surveillance Devices [closed]

There is a very suspicious man living in my building. I noticed a new imbedded device at the shared entrance which he claims is a monoxide detector. As an aside, there is no need for a monoxide ...
1
vote
0answers
367 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
7
votes
1answer
3k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
0
votes
1answer
59 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
0
votes
0answers
43 views

Best practice regarding secure administration on lots of embedded Linux devices [duplicate]

Lets say I've a lot of embedded Linux devices, like 100. How do I access and administer these devices securely? Is it best practice create a key pair and put the put the public key on all the devices?...
3
votes
1answer
315 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
2
votes
2answers
182 views

Way to combine encrypted tar and encrypted symmetric key with which tar was encrypted?

We are using Beaglebone Black (AM335x) based custom board, so for firmware upgrades of the board we will be using an encrypted firmware image. As you would have already guessed, we will be using ...
1
vote
1answer
634 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working on ...
3
votes
2answers
2k views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
6
votes
1answer
796 views

Does CAN bus communication need encryption?

I'm currently researching into CAN security for in-vehicle communication. I would like to know if anyone knows a reason why the CAN payloads of an ECU communication (between CAN nodes) should be ...
7
votes
2answers
3k views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...
3
votes
2answers
887 views

How to handle root passwords for a number of embedded linux boxes?

Let's say I create a device which has an embedded Linux box in it (for example, a Raspberry Pi). After booting up, it starts the main application which is designed to provide the UI for the device. ...
3
votes
2answers
75 views

Guidelines for password register size in embedded devices

I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
3
votes
1answer
4k views

How to speed up slow TLS handshake on ESP8266 running mbed TLS?

I'm developing a system consisting of a mobile application and an embedded device that talk to each other. I'm using mbed TLS (formerly known as Polar SSL). The problem is that the embedded device ...
1
vote
3answers
506 views

Is a pre-set password in an embedded system secure enough?

I have a safety-critical embedded device, which sends data updates (in get requests) and pulls settings from a server. The device uses an embedded microcontroller/wifi chipset called the Particle P1; ...
3
votes
2answers
261 views

Caging unsecure internet facing IOT device

Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses. ...
10
votes
3answers
1k views

How Should WiFi Passwords be securely stored on IOT (embedded) devices?

Some devices need to store and (re)use a password (not the hash) like your mobile phone using home wifi, SmartTV, etc; How should they store the password on their flash storage? So that a person who ...
1
vote
1answer
2k views

security updates for embedded firmware Tomato (router) [closed]

I installed on my Linksys router Tomato firmware. I saw and now don't understand how security updates work. It can't be that there is no vulnerability since 2010. Tomato Firmware v1.28.1816 ...
-3
votes
3answers
120 views

Is this hypothetical system secure?

I would like to build a simple system, are there any obvious security flaws in it? Will this hashing mechanism be fairly secure without any other layers of encryption? I have a simple module where ...
0
votes
2answers
98 views

Modular security for a photography UAV?

Is modular security possible? In the context of an embedded device, is it possible to create an add-in module that will be responsible for both communications and security, with his role being ...
4
votes
3answers
378 views

How can the secret and keys be read out from the bus?

I heard that the attacks that focus on the bus between chip's blocks (e.g. between CPU and functional blocks / memory blocks) are possible. ​ The buses become the weak parts of hardware security.​ ...
3
votes
3answers
258 views

How dangerous is the remote Jeep Cherokee attack?

Recently two researchers working with a Wired Magazine reporter have demonstrated a serious vulnerability in UConnect, the software that powers the onboard entertainment systems of all Chrysler group ...
2
votes
1answer
106 views

How can an embedded system support HTTPS and also keep an SSL key safe

I read another question about an embedded https daemon, which got me wondering: How might one maintain secrecy about the private key within such an embedded system? My logic is: If the device ships ...
4
votes
1answer
159 views

Terminology: What kind of security applies to industrial control systems, fire alarm systems, etc.?

I am wondering what you would call the kind of security that applies to systems such as industrial control (SCADA) systems, building automation systems, fire alarm systems, etc. These systems are ...