Defense-in-depth for embedded devices
Download as PPTX, PDF0 likes238 views
This presentation discusses defense-in-depth strategies for embedded devices. It outlines various attack vectors at different levels of an embedded device stack, from hardware components to firmware to applications. It then describes corresponding countermeasures to protect against each attack vector. The attack vectors include device reconnaissance, tampering with hardware components, exploiting debug interfaces, firmware reverse engineering, software flaws, and application vulnerabilities. The countermeasures center around techniques like obfuscation, encryption, authentication, exception handling, updates, and using secure protocols. The presentation aims to help secure embedded devices against hacks and protect their integrity.
Defense-in-depth for embedded devices
- 2. DISCLAIMER The opinions and thoughts presented during the course of this presentation are my own and do not reflect the views or positions of my employer. 2
- 3. #whoami • A security evangelist • Working with Resideo (Honeywell Homes) – Product Security • Contributor towards security communities; IS-RA, null, CysInfo, h1hakz, ISC2. • Speaker at security conferences RSA, c0c0n, IoT day etc. • Having security certifications from Offensive Security, SANS and EC- Council • Interested in IoT, ICS and SCADA Security 3
- 4. Agenda • To know about embedded devices attack surface • And to protect them against hack
- 5. How is Embedded Device look like?
- 6. Embedded Device Stack • Attack Vectors • Device reconnaissance • Web Search Engines • FCCID • Open Source Libraries • Tempering the Device • Chip/components Identification • Datasheets • Pin-out Probes Hardware Components Hardware Protocols Boot/RootFS Application/Platform Kernel Bootloader / Firmware • Countermeasures • To protect the device IP • Service/User Manuals • Test Documents on FCCID • Securing Open source Libraries • Chip morphing • Temper Protection
- 7. Embedded Device Stack • Attack Vectors • JTAG • UART • SPI • I2C • CANBUS • BDS Hardware Components Hardware Protocols Boot/RootFS Kernel Bootloader / Firmware Application/Platform • Countermeasures • Obfuscation of pin-outs • Remove the Traces • Blow Fuse in Pin-Outs • Encryption/Authentication • Key Token • Power Toggle • Read out Protections • Randomizing Probes • Set option Bits • Validating Assembly • CRC/ HASH • Custom Baud Rate
- 8. Embedded Device Stack • Attack Vectors • U-Boot • RootFS • Firmware Signature • Root Certificates Hardware Components Hardware Protocols Boot/RootFS Kernel Bootloader / Firmware Application/Platform • Countermeasures • Run Time key Generation • Safe Zones • Using Secondary memory • Secure Boot enable • Authenticated RootFS • Obfuscated Signatures
- 9. Embedded Device Stack • Attack Vectors • Memory Leakage • Stack overflow • Buffer Overflow • Unmanaged code • Kernel Crash • Unhandled exception • Side Channels Faults • Power glitching • NAND/Clock glitching • ThermalHardware Components Hardware Protocols Boot/RootFS Kernel Bootloader / Firmware Application/Platform • Countermeasures • Memory management • Exception handling • Fixing Zero days • Crash reporting/Self Healing • Circuit Power Handling • Glitch detectors • Brownout detectors • Lockstep cores • Asynchronous internal clock with dummy cycles • Internal Oscillators • Halt on invalid instruction execution • Lock down unnecessary diagnostic signals • Mutable codes
- 10. Embedded Device Stack • Attack Vectors • Firmware Emulation • Reverse Engineering • Compression/Encryption • Hardcoded Credentials/Keys/Certificates • PII • Key Generation Algo • Backdoors Hardware Components Hardware Protocols Boot/RootFS Kernel Bootloader / Firmware Application/Platform • Countermeasures • Encryption • Compression • Obfuscation • Encoding • Certificates • Signatures • Run time Keys • Run time protection • Remove Backdoors • Randomized functions • Secure APIs/Libraries • Integral Updates • Complex key generations • Root of trust / Chain of Trust • Avoid Secondary memory
- 11. Embedded Device Stack • Attack Vectors • Application Flaws • COAP • MQTT Hardware Components Hardware Protocols Boot/RootFS Kernel Bootloader / Firmware Application/Platform • Countermeasures • Secure API implementation • Auth Mechanism • Reliable node detection • Active search engine scans • Secure 3rd party libraries • TLS
- 12. Take Away