💻 12 common attacks on embedded systems
Interesting article that sums up the most popular attack types on embedded systems.
Software-based attacks: target the brains of the system — the application that manages the devices. A successful attack on software allows a hacker to access data or gain control over an embedded system. Searching for vulnerabilities in software design and code is the most popular vector of attack because it’s possible to conduct such an attack remotely.
Network-based attacks: exploits network infrastructure vulnerabilities and can also be performed remotely. Using these vulnerabilities, hackers can listen for, intercept, and modify traffic transmitted by an embedded system.
Side-channel attacks: intend to use hardware security flaws in embedded systems to hack them. A side-channel attack is the hardest and most expensive type of attack, as it requires precise knowledge of the hardware design and physical availability of the target system.
More information...
#articles #security
Interesting article that sums up the most popular attack types on embedded systems.
Software-based attacks: target the brains of the system — the application that manages the devices. A successful attack on software allows a hacker to access data or gain control over an embedded system. Searching for vulnerabilities in software design and code is the most popular vector of attack because it’s possible to conduct such an attack remotely.
Network-based attacks: exploits network infrastructure vulnerabilities and can also be performed remotely. Using these vulnerabilities, hackers can listen for, intercept, and modify traffic transmitted by an embedded system.
Side-channel attacks: intend to use hardware security flaws in embedded systems to hack them. A side-channel attack is the hardest and most expensive type of attack, as it requires precise knowledge of the hardware design and physical availability of the target system.
More information...
#articles #security
🎬 Creating IoT Devices That Will Remain Secure
What is secure today may not be secure in the future, and even if you include an IoT device with state-of-the-art security, it may be surrounded by less secure devices.
Steve Hanna, distinguished engineer at Infineon, talks with Semiconductor Engineering about the impact of security on IoT adoption, why resilience across a system is the new target for secure designs, and how to minimize the impact of less secure devices.
https://youtu.be/OI8W9EIWHZI
#video #podcasts #IoT #security
What is secure today may not be secure in the future, and even if you include an IoT device with state-of-the-art security, it may be surrounded by less secure devices.
Steve Hanna, distinguished engineer at Infineon, talks with Semiconductor Engineering about the impact of security on IoT adoption, why resilience across a system is the new target for secure designs, and how to minimize the impact of less secure devices.
https://youtu.be/OI8W9EIWHZI
#video #podcasts #IoT #security
YouTube
Creating IoT Devices That Will Remain Secure
What’s secure today may not be secure in the future, and even if you include an IoT device with state-of-the-art security, it may be surrounded by less secure devices. Steve Hanna, distinguished engineer at Infineon, talks with Semiconductor Engineering about…
👍2
💻 Shedding too much Light on a Microcontroller’s Firmware Protection
Almost every microcontroller with integrated flash features firmware readout protection. This is a form of content protection which aims at securing intellectual property (IP) as well as cryptographic keys and algorithms from an adversary.
One series of microcontrollers are the STM32 which have recently gained popularity and thus are increasingly under attack. However, no practical experience and information on the resilience of STM32 microcontrollers is publicly available.
The paper presents the first investigation of the STM32 security concept, especially targeting the STM32F0 sub-series.
More information...
#articles #security
Almost every microcontroller with integrated flash features firmware readout protection. This is a form of content protection which aims at securing intellectual property (IP) as well as cryptographic keys and algorithms from an adversary.
One series of microcontrollers are the STM32 which have recently gained popularity and thus are increasingly under attack. However, no practical experience and information on the resilience of STM32 microcontrollers is publicly available.
The paper presents the first investigation of the STM32 security concept, especially targeting the STM32F0 sub-series.
More information...
#articles #security
👍2
📃 Exploring Xiaomi’s new firmware security measures
The author of the article sharing his research on cryptographic signature-based firmware authenticity checks recently added to the Xiaomi Mi scooter firmware. Those scooters use an Over-The-Air (OTA) firmware update mechanism over BLE, so you can update your scooter using nothing but a smartphone app – great because you can easily get all the good new features, but suboptimal because you can easily get all the bad new features.
As an owner of a Mi 1S scooter but a hacker first and foremost, author set up a HTTPS proxy and captured the firmware files that the app downloaded from Xiaomi servers, dug into them, and summarized what he found.
Unlike many of the security measures we’ve seen lacking-by-design, this one secures the OTA firmware updates with what we would consider the industry standard – SHA256 hash with elliptic cryptography-backed signing.
More information...
#articles #security
The author of the article sharing his research on cryptographic signature-based firmware authenticity checks recently added to the Xiaomi Mi scooter firmware. Those scooters use an Over-The-Air (OTA) firmware update mechanism over BLE, so you can update your scooter using nothing but a smartphone app – great because you can easily get all the good new features, but suboptimal because you can easily get all the bad new features.
As an owner of a Mi 1S scooter but a hacker first and foremost, author set up a HTTPS proxy and captured the firmware files that the app downloaded from Xiaomi servers, dug into them, and summarized what he found.
Unlike many of the security measures we’ve seen lacking-by-design, this one secures the OTA firmware updates with what we would consider the industry standard – SHA256 hash with elliptic cryptography-backed signing.
More information...
#articles #security
👍10
📃 What are best practices for IoT system security?
Fierce Electronics reached out to experts on their best practices:
▫️ The latest software is the most secure. That’s because it addresses currently known threats (CVEs or Common Vulnerabilities and Exposures). CVEs are fixed first upstream (for open source) and in new software releases for proprietary software.
▫️ Open-source platforms are open to scrutiny and continually updated to counter latest threats.
▫️ A unique Root of Trust should be installed on every device.
▫️ ALL software on an end device should be updatable - we don't know what we don't know as we learned with Spectre and Meltdown. This includes secure boot firmware on Arm and BIOS on x86.
▫️ Device provisioning should be simple and not involve the end user. This means secure device onboarding.
▫️ The OTA (Over the Air) update platform itself must be secure, obviously! This includes The Update Framework (TUF).
More information...
#articles #security #IoT
Fierce Electronics reached out to experts on their best practices:
▫️ The latest software is the most secure. That’s because it addresses currently known threats (CVEs or Common Vulnerabilities and Exposures). CVEs are fixed first upstream (for open source) and in new software releases for proprietary software.
▫️ Open-source platforms are open to scrutiny and continually updated to counter latest threats.
▫️ A unique Root of Trust should be installed on every device.
▫️ ALL software on an end device should be updatable - we don't know what we don't know as we learned with Spectre and Meltdown. This includes secure boot firmware on Arm and BIOS on x86.
▫️ Device provisioning should be simple and not involve the end user. This means secure device onboarding.
▫️ The OTA (Over the Air) update platform itself must be secure, obviously! This includes The Update Framework (TUF).
More information...
#articles #security #IoT
👍4👎1
📃 The curious case of the Raspberry Pi in the network closet
A short story about how author found, analyzed and in the end caught the culprit of a malicious device in their network.
More information...
#articles #security
A short story about how author found, analyzed and in the end caught the culprit of a malicious device in their network.
More information...
#articles #security
👍2
🎬 How I hacked a hardware crypto wallet and recovered $2 million
I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA). Knowing that existing research was already out there for this device, it seemed like it would be a slam dunk. Little did I realize the project would turn into a roller coaster ride with over three months of experimentation, failures, successes, and heart-stopping moments. It reminded me that hacking is always unpredictable, exciting, and educational, no matter how long you've been doing it. In this case, the stakes were higher than normal: I only had one chance to get it right.
https://youtu.be/dT9y-KQbqi4
#video #electronics #security
I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA). Knowing that existing research was already out there for this device, it seemed like it would be a slam dunk. Little did I realize the project would turn into a roller coaster ride with over three months of experimentation, failures, successes, and heart-stopping moments. It reminded me that hacking is always unpredictable, exciting, and educational, no matter how long you've been doing it. In this case, the stakes were higher than normal: I only had one chance to get it right.
https://youtu.be/dT9y-KQbqi4
#video #electronics #security
YouTube
How I hacked a hardware crypto wallet and recovered $2 million
I was contacted to hack a Trezor One hardware wallet and recover $2 million worth of cryptocurrency (in the form of THETA). Knowing that existing research was already out there for this device, it seemed like it would be a slam dunk. Little did I realize…
👍7👎2👌1
🔐 5 Elements to a Secure Embedded System (series of articles)
Nearly every embedded system requires some level of security, whether its just the basics to lock down the programming port or something more complex to protect a connected device from hackers.
For many developers, securing their device can be intimidating especially given that many embedded developers don’t come from a security background and have to learn security concepts on the fly. When it comes to establishing the primary elements that form the foundation for a secure system, the five elements every developer should be looking to implement are:
▫️ Hardware based isolation
▫️ A Root-of-Trust (RoT)
▫️ A secure boot solution
▫️ A secure bootloader
▫️ Secure storage
The author dives into each of these topics in greater detail in order to understand how to create a solid security foundation from which a system can be built.
More information...
#articles #security
Nearly every embedded system requires some level of security, whether its just the basics to lock down the programming port or something more complex to protect a connected device from hackers.
For many developers, securing their device can be intimidating especially given that many embedded developers don’t come from a security background and have to learn security concepts on the fly. When it comes to establishing the primary elements that form the foundation for a secure system, the five elements every developer should be looking to implement are:
▫️ Hardware based isolation
▫️ A Root-of-Trust (RoT)
▫️ A secure boot solution
▫️ A secure bootloader
▫️ Secure storage
The author dives into each of these topics in greater detail in order to understand how to create a solid security foundation from which a system can be built.
More information...
#articles #security
👍7👎2
📟 BYOPM - Open-Source password manager based on Raspberry Pi Zero
BYOPM is a portable Password Manager implementation based on BitWarden and a Raspberry PI Zero. It’s a self hosted solution, with full functionality, which is activated by just plugging the device on your computer. Bitwarden’s Official browser addons and extensions are also supported, and the device has been tested both on Windows (10 and 11) and Linux (Debian Based).
More information...
#projects #raspberry #security
BYOPM is a portable Password Manager implementation based on BitWarden and a Raspberry PI Zero. It’s a self hosted solution, with full functionality, which is activated by just plugging the device on your computer. Bitwarden’s Official browser addons and extensions are also supported, and the device has been tested both on Windows (10 and 11) and Linux (Debian Based).
More information...
#projects #raspberry #security
👍5
📃 MISRA C: Write safer, clearer C code
The C language is compact, expressive and powerful. It provides a programmer with the means to write efficient, readable and maintainable code. All of these features account for its popularity. Unfortunately, the language also enables the unwary developer to write dangerous, insecure code that can cause serious problems at all stages of a development project and into deployment.
In the late 90s, the Motor Industry Software Reliability Association (MISRA) introduced a set of guidelines for the use of C in vehicle systems, which became known as MISRA C. Since then, the guidelines have been steadily refined, with updates being published from time to time.
Although the guidelines were originally aimed at developers of software for use in cars, it was quickly realized that they are equally applicable to many other application areas where safety is critical, and the standard is now widely adopted in many industries.
More information...
#articles #security
The C language is compact, expressive and powerful. It provides a programmer with the means to write efficient, readable and maintainable code. All of these features account for its popularity. Unfortunately, the language also enables the unwary developer to write dangerous, insecure code that can cause serious problems at all stages of a development project and into deployment.
In the late 90s, the Motor Industry Software Reliability Association (MISRA) introduced a set of guidelines for the use of C in vehicle systems, which became known as MISRA C. Since then, the guidelines have been steadily refined, with updates being published from time to time.
Although the guidelines were originally aimed at developers of software for use in cars, it was quickly realized that they are equally applicable to many other application areas where safety is critical, and the standard is now widely adopted in many industries.
More information...
#articles #security
👍12👌5👎1
💻 Are text strings a vulnerability in embedded software?
For many years, the security of desktop computers has been a concern. Once a machine is connected to the Internet, there is intrinsically a possibility for some kind of attack.
Embedded systems always seemed to be immune from such problems, as they were rarely networked, and their code was normally in ROM of some kind. Things have changed. A large proportion of modern systems are connected to the Internet and it is common practice for code to be copied into RAM and executed from there.
The goal of data obfuscation is to delay or deter the hacker by simply making the data less recognizable for what it is. Scanning through a memory dump, one of the easy things to spot is text strings.
More information...
#articles #programming #security
For many years, the security of desktop computers has been a concern. Once a machine is connected to the Internet, there is intrinsically a possibility for some kind of attack.
Embedded systems always seemed to be immune from such problems, as they were rarely networked, and their code was normally in ROM of some kind. Things have changed. A large proportion of modern systems are connected to the Internet and it is common practice for code to be copied into RAM and executed from there.
The goal of data obfuscation is to delay or deter the hacker by simply making the data less recognizable for what it is. Scanning through a memory dump, one of the easy things to spot is text strings.
More information...
#articles #programming #security
👍8
In the realm of cybersecurity, the O.MG cable stands as a potent tool, offering hackers an inconspicuous means to infiltrate devices. This modified USB cable, disguised as an ordinary connector, thrives on its ability to blend into any environment. Hackers can surreptitiously deploy it in public spaces, patiently awaiting an unwitting victim to connect.
Once plugged in, the O.MG cable grants hackers remote access to the target device, equipped with hidden hardware for covert control. It facilitates data exfiltration, allowing hackers to discreetly siphon sensitive information, including passwords and files.
The dual nature of the O.MG cable, as both a commonplace accessory and a hacker's silent weapon, underscores the evolving challenges in the ongoing battle for digital security. Its deceptive appearance, remote capabilities, and data exfiltration potential make it a formidable asset in the world cybercrime.
#articles #security
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
👍19👌2
The YouTube video demonstrates how a Raspberry Pi Pico can exploit a vulnerability in BitLocker encryption, revealing the potential risks associated with this widely used security feature.
BitLocker, a full disk encryption system integrated into Windows, is commonly employed to safeguard sensitive data on devices such as laptops and desktops. The video shows the hardware and techniques needed to execute the exploit, emphasizing its affordability and ease of implementation.
#video #raspberry #security
Please open Telegram to view this post
VIEW IN TELEGRAM
👍6👌2
Pwnagotchi is an open-source project designed to explore and exploit vulnerabilities in Wi-Fi networks, utilizing artificial intelligence and Raspberry Pi hardware. Inspired by Tamagotchi pets, it offers a playful approach to network security exploration.
Features of the device:
Pwnagotchi provides an accessible tool for learning about network security and encryption, encouraging ethical hacking practices. By actively engaging in Wi-Fi network exploration, users gain insights into vulnerabilities and learn to better secure their networks. Its user-friendly design caters to both beginners and experienced security professionals.
More information:
#projects #raspberry #security
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
👌10👍5👎1
The UK has recently implemented strict cybersecurity laws for IoT devices, aimed at protecting consumers from cyber threats and reducing cyber crimes. For instance, the new laws prohibit easy passwords like “admin” or “12345” and require manufacturers to ensure robust security measures for internet-connected devices.
This initiative addresses the high vulnerability of smart homes, which can face thousands of hacking attempts weekly. The law also mandates manufacturers to publish policies for reporting security flaws, set minimum periods for security updates, and provide secure software update mechanisms.
#news #IoT #security
Please open Telegram to view this post
VIEW IN TELEGRAM
👍14👌2
A global IT outage affecting 8.5 million Windows devices was caused by a faulty update from CrowdStrike, leading to significant disruptions. The issue stemmed from a null pointer bug in the C++ code of the update, which triggered widespread system crashes. Specifically, the program attempted to access memory at an invalid address ("
0x000000000000009c"), resulting in a cascade of failures across various critical services and platforms.Many experts argue that if the update had been written in
#news #crowdstrike #rust #programming #security
Please open Telegram to view this post
VIEW IN TELEGRAM
👎13👍6👌2
Ecovacs Deebot vacuums have been caught gathering photos, videos, and voice recordings inside users' homes to train AI models. Despite privacy concerns, the company claims users willingly participate in a data collection program aimed at improving product functionality.
The program involves collecting 2D/3D house maps, microphone recordings, and camera images, some of which may be retained even if deleted. While Ecovacs says the data helps enhance AI capabilities, the company is under scrutiny due to cybersecurity flaws that could expose sensitive user information.
A similar issue arose with iRobot when intimate images taken by its vacuums were leaked online by contractors analyzing the footage, raising broader concerns about how companies handle user data. These incidents highlight the growing need for stronger safeguards to protect consumer privacy in smart home devices.
#news #robots #artificial_intelligence #security
Please open Telegram to view this post
VIEW IN TELEGRAM
👍4👌2
Researchers have discovered an undocumented backdoor in the ESP32 chip, used in over a billion devices worldwide. This vulnerability could allow attackers to access data, spoof devices, and infiltrate networks.
Spanish security experts found 29 hidden commands in the chip’s Bluetooth firmware. These commands enable memory manipulation, MAC address spoofing, and advanced Bluetooth attacks. Hackers could potentially exploit these functions to take full control of affected devices and move laterally within networks.
If exploited, this backdoor could enable long-term persistence and spread to other devices. The lack of public documentation from Espressif raises concerns about security risks and potential misuse.
#news #esp32 #security
Please open Telegram to view this post
VIEW IN TELEGRAM