View source for Top 10 2014-I9 Insecure Software/Firmware Updates

<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center>

{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
{{Top_10:SummaryTableTemplate|exploitability=3|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the device and/or the network the device resides on.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses multiple vectors such as capturing update files via unencrypted connections, the update file itself is not encrypted or they are able to perform their own malicious update via DNS hijacking. Depending on method of update and device configuration, attack could come from the local network or the internet.

</td>
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Insecure software/firmware updates are present when the updated files themselves and the network connection they are delivered on are not protected. Software/Firmware updates can also be insecure if they contain hardcoded sensitive data such as credentials. Security issues with software/firmware updates are relatively easy to discover by simply inspecting the network traffic during the update to check for encryption or using a hex editor to inspect the update file itself for interesting information.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Insecure software/firmware updates could lead to compromise of user data, control over the device and attacks against other devices.

</td>
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact if data can be stolen or modified and devices taken control of for the purpose of attacking other devices.  Could your customers be harmed? Could other users be harmed?

</td>
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}

{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Are My Software/Firmware Updates Secure?|position=firstLeft|year=2013|language=en}}
The simplest way to check for insecure software/firmware updates is to review the update file itself and also the communication method used to transmit those updates. The update file should also be reviewed for exposure of any sensitive data in human readable format by someone using a hex edit tool.

{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Software/Firmware Updates?|position=right|year=2013|language=en}}
Securing software/firmware updates require:
# Ensuring the update file is encrypted.
# Ensuring the update file is transmitted via an encrypted connection.
# Ensuring the update file does not contain sensitive data.
# Ensuring the update is signed and verified before allowing the update to be uploaded and applied.
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
'''Scenario #1:''' Update file is transmitted via HTTP.

{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
<nowiki>http://www.xyz.com/update.bin</nowiki>

</span>{{Top_10_2010:ExampleEndTemplate}}
'''Scenario #2:''' Update file is unencrypted and human readable data can be viewed.
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
�v�ñ]��Ü��Qw�û]��ˇ3DP�Ö�∂]��ˇ3DPadmin.htmadvanced.htmalarms.htm

</span>{{Top_10_2010:ExampleEndTemplate}}
In the cases above, the attacker is able to either capture the update file or capture the file and view it's contents.


{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=1|year=2013|language=en}}
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}

{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}