Questions tagged [embedded-system]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
62 views

USB Flash Disk with Piracy Protection [closed]

Is there any USB flash disk that is resistant to cloning. I mean, not just copying and pasting the data. I found YubiKey & NitroKey can store only passwords, keys and certificates, but they do not ...
1
vote
1answer
64 views

Self-signed certificates in embedded IoT device

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC). These IoT nodes would be deployed and, during ...
0
votes
2answers
52 views

Authentication Certificates in Embedded System (Microcontroller)

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices. In order to have a proper security I´m thinking about using Authentication Certificates ...
2
votes
0answers
58 views

Storing a key in SRAM in an embedded device

I'm working on an embedded device which need to decrypt a file in USB stick using a secret key. I read many questions about storing a key in embedded device and found that it's secure to store a key ...
0
votes
1answer
182 views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
3
votes
1answer
147 views

Trusted CA SSL certificates and embedded devices

There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server ...
3
votes
1answer
156 views

Best practices to manage password for embedded Linux devices

Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
2
votes
4answers
166 views

Embedded system - is it a good idea to run the user application as root?

I'm working on a Linux powered consumer electronics. Everything user interacts with is running as root (legacy design). Should I make the application run as its own user with restrictions?
3
votes
2answers
263 views

How does a security countermeasure failure impact a system?

In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a ...
4
votes
2answers
146 views

Deactivate Linux Shell to prevent “blind” login on router

Today I analyzed my home router. I connected a keyboard to the router's USB port, which is usually used for mass storage devices. However, I pressed the key combination to reboot a Linux system from ...
0
votes
1answer
127 views

How can vulnerability researchers find flaws in OSes / Embedded Systems?

Operating Systems and Embedded Systems usually don't come with source code or binaries that one can review. How can a vulnerability researcher look for flaws in a system (Architecture, Protocols, etc....
1
vote
0answers
71 views

minimum resource requirements for a TLS handshake

What are the minimum resource requirements to to a TLS handshake? Is it possible to do a full TLS handshake on very low powered devices? Are there any sources on this? Can TLS be configured in some ...
3
votes
1answer
402 views

Individual public keys for embedded devices?

I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data. The device is an embedded system which can be programmed only ...
0
votes
1answer
98 views

How applications are installed in TEE and REE

I am trying to understand the difference between the TEE (Trusted Execution Environment) and REE (Rich Execution Environment) in an electronic component. I understand that for security reasons, there ...
2
votes
1answer
607 views

using secure boot in embedded systems

The whole idea about using Secure Boot in Embedded Systems to boot an operating system is new to me. I've never paid much attention to it previously. I just know that it prevents the loading at start-...
2
votes
0answers
193 views

GPG - Use case for embedded system

I'm looking to add encryption to an embedded data logger and I'd really appreciate some advice to make sure that my approach is reasonable/secure. The user will load a GPG public key onto the device. ...
0
votes
1answer
193 views

Embedded Linux: Is removing SSH alone good enough to ensure security of file system?

On my embedded Linux product, I have done the following: Disable root Remove SSH from the final product Normally, a non-root user (used for development) can do lots of damaging stuff, such as ...
0
votes
1answer
263 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
3
votes
2answers
413 views

DRM using embedded private key

I've started learning about cryptography used for DRM solutions, and curious to know if this is a valid solution for a custom embedded system running purchased software assets. ECDSA public / private ...
0
votes
1answer
254 views

Security Advantages of Azure Sphere vs other embedded OS

I know Azure Sphere is new, and to my understanding Microsoft is targeting the embedded IOT market, but how is Azure Sphere more secure than other embedded RTOS systems like VxWorks or Integrity? Don'...
8
votes
1answer
2k views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
7
votes
3answers
958 views

Hashing a large file on an embedded system

I'm trying to come up with a way to verify the authenticity of a file that I'm downloading from a server to an embedded system. I'm thinking of using a hash (SHA256 preferably). My main concern is ...
0
votes
0answers
141 views

Why, in a certificate, TBS is before alg id?

From an embedded systems point of view it is inefficient to put the alg ID after TBS data in a certificate since an embedded system may not have a lot of hashing implementation and thus may not be ...
4
votes
0answers
132 views

How can I properly secure the WiFi setup process of an IoT device?

My company develops a WiFi-connected IoT product. I want to make sure that the process of getting the user's WiFi credentials into the device is as safe as possible. At the moment, the product is in a ...
3
votes
1answer
313 views

Are MCUs (Like arduinos) effected by Meltdown?

I am curious if Microcontrolers are effected by the vulnerabilities of Meltdown and Spectre. These devices are not specifically CPUs, and do not run Operating Systems per-say. I'm not really sure I ...
-2
votes
2answers
901 views

What are the best practices to implement secured remote firmware updates over-the-air (OTA)?

Firmware over the air (FOTA) is a general name for performing firmware updates remotely. Assume I have a microcontroller with RW memory and a boot loader. What's the right way to do firmware ...
5
votes
0answers
46 views

Is there a good way to store OAuth2 tokens for a native application?

Currently I have a native PC application that builds and uploads a configuration to an embedded Linux device (i.e. the client). This device connects to Google Calendar via their OAuth2 API. The ...
0
votes
2answers
1k views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
0
votes
3answers
2k views

how to implement TLS between web-server and embedded devices

I am working on remote light control system. The devices/controllers are like raspberry pi sized units running embedded programs to accept commands from a management application running on remote web-...
4
votes
1answer
719 views

Sending data securely from a microcontroller to a server

I wish to transfer data securely from an arduino (a microcontroller) to a server. The obvious solution is probably to use TLS, but arduino does not have the capability to run it. I did not find ...
5
votes
1answer
519 views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
0
votes
2answers
1k views

Pentest for Embedded Linux Device

First things that I am trying to discover using pentest: Files permissions (are sensitive files in my Linux build secure from exploits) Are programs running under users (e.g., something running under ...
7
votes
1answer
1k views

Security essentials for a embedded Linux device

We are prototyping a security camera product using Raspberry Pi 3 as the hardware platform. The camera has capability to connect to the cloud over internet as well as offline processing when the ...
0
votes
1answer
460 views

How to detect, if ESP32 or ESP2866 IoT devices hide malicious in their firmware?

ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN. Unfortunately the firmware of these devices is still closed source and quite large. It is there any ...
0
votes
1answer
374 views

Code signing certificate for embedded application

Preview: I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use ...
0
votes
2answers
746 views

Can Haveged help increasing entropy and make PRNG unpredictable (close to TRNG) on embedded Linux based headless device?

We have OpenSSL on BealgboneBlack Based Embedded Linux custom board and we were thinking about increasing randomness of PRNG(/dev/urandom). While browsing about it, I landed on this page: How to ...
1
vote
1answer
290 views

Access control for embedded device

We develop a protocol for computer remote control of a certain kind of toy. It's basically a sensor and actor network that is usually connected to the user PC via serial port or USB. Now some users ...
4
votes
1answer
9k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
-1
votes
1answer
124 views

how to utilize openssl (already integrated with kernel) with openvpn? [closed]

the Embedded linux kernel is generated with openssl so i want to use this openssl with the other application eg. openvpn rather than compiling openssl and using it with openvpn just so that ...
1
vote
0answers
124 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
0
votes
2answers
173 views

Embedded Surveillance Devices [closed]

There is a very suspicious man living in my building. I noticed a new imbedded device at the shared entrance which he claims is a monoxide detector. As an aside, there is no need for a monoxide ...
1
vote
0answers
480 views

Encrypting OTA software updates files for embedded devices

I need to encrypt and send update files of the order of 100K from a server, through a mobile app, to low power wireless embedded devices (32 bit). The file transfers will be infrequent. The mobile ...
10
votes
1answer
4k views

How do I deal with a compromised network device?

I suspect that a network device (modem, router. switch, access point, etc) is compromised. What should I do?
0
votes
1answer
64 views

3rd Party Vulnerabilities Fix (Access to source code vs no access to source code)

I've embedded system software with listed vulnerabilities from a static code analyser tool. Since it is an embedded system, and I don't have access to some of the source code (being 3rd party) for ...
2
votes
1answer
519 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
2
votes
2answers
242 views

Way to combine encrypted tar and encrypted symmetric key with which tar was encrypted?

We are using Beaglebone Black (AM335x) based custom board, so for firmware upgrades of the board we will be using an encrypted firmware image. As you would have already guessed, we will be using ...
1
vote
1answer
889 views

Firmware protection scheme

Edit: I have found a scheme that fits my limits (little memory, only AES is available): AES-CMAC described in RFC 4493 (just remember to use different key for encryption and MAC ;) . I am working on ...
3
votes
2answers
3k views

How do I handle HTTPS certificates for a device with dynamic IP?

I'm fairly new to HTTPS and therefore risk this being a dumb question. I have a server hosted on my Raspberry Pi that allows me to configure it remotely, over a network and I'd like to convert to ...
6
votes
1answer
1k views

Does CAN bus communication need encryption?

I'm currently researching into CAN security for in-vehicle communication. I would like to know if anyone knows a reason why the CAN payloads of an ECU communication (between CAN nodes) should be ...
10
votes
3answers
4k views

Best practices to implement HTTPS in embedded devices

Embedded devices, such as routers, IP cameras, generally provide HTTPS access to the admin interface. These HTTPS implementations generally have a lot of problems (non-unique certificates, self-signed ...