OWASP Internet of Things Project - Revision history

Aaron.guzman at 07:02, 1 November 2019

2019-11-01T07:02:32Z

Aaron.guzman: .

2019-10-31T15:08:15Z

Aaron.guzman: .

2019-10-31T15:06:40Z

Aaron.guzman: .

2019-10-31T15:03:27Z

Aaron.guzman: FSTM

2019-10-31T14:49:56Z

FSTM

Aaron.guzman: /* Medical Device Testing */

2019-10-31T14:38:04Z

‎Medical Device Testing

Aaron.guzman at 18:01, 4 October 2019

2019-10-04T18:01:51Z

Aaron.guzman at 17:38, 4 October 2019

2019-10-04T17:38:29Z

Aaron.guzman at 23:17, 17 September 2019

2019-09-17T23:17:21Z

Aaron.guzman at 23:06, 17 September 2019

2019-09-17T23:06:45Z

@@ Line 354: / Line 354: @@
 |9. Binary Exploitation
 |Exploit identified vulnerabilities discovered in previous  stages to attain root and/or code execution
-|}The full methodology release can be downloaded via the following TBD.
+|}The full methodology release can be downloaded via the following https://github.com/scriptingxss/owasp-fstm/releases/download/v1.0/Firmware_Security_Testing_Methodology_Version1.pdf.
 {{Social Media Links}}
@@ Line 374: / Line 374: @@
 == Quick Download ==
-* TBD
+* https://github.com/scriptingxss/owasp-fstm/releases
 |}

@@ Line 311: / Line 311: @@
 == Quick Download ==
 * https://gitlab.com/bytesweep/bytesweep/blob/master/INSTALL.md
 |}
@@ Line 1,120: / Line 1,184: @@
 == News and Events ==
 * Coming Soon
 |}

@@ Line 146: / Line 146: @@
 |}
-= Seek & Understand =
+= IoT Top 10 =
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
@@ Line 184: / Line 182: @@
 * [[Top 10 2014-I10 Poor Physical Security|I10 Poor Physical Security]]
-== OWASP IoT Top 10 2018 Mapping Project ==
+= OWASP IoT Top 10 2018 Mapping Project =
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 | style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |

@@ Line 10: / Line 10: @@
 ''The OWASP Internet of Things Project is designed to help manufacturers, developers, and consumers better understand the security issues associated with the Internet of Things, and to enable users in any context to make better security decisions when building, deploying, or assessing IoT technologies''.
-The project looks to define a structure for various IoT sub-projects such as Attack Surface Areas, Testing Guides, Tools, and Top Vulnerabilities.
+The project looks to define a structure for various IoT sub-projects separated into the following categories - Seek & Understand, Validate & Test, and Governance.
 ==Updated!==
@@ Line 146: / Line 146: @@
 |}
-= IoT Top 10 =
+= Seek & Understand =
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
@@ Line 182: / Line 184: @@
 * [[Top 10 2014-I10 Poor Physical Security|I10 Poor Physical Security]]
-= OWASP IoT Top 10 2018 Mapping Project =
+== OWASP IoT Top 10 2018 Mapping Project ==
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 | style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
@@ Line 1,292: / Line 1,294: @@
 |}
 =Project About=

@@ Line 1,079: / Line 1,079: @@
 * [https://github.com/scriptingxss/IoTGoat OWASP IoTGoat]
 |-
 |}
 = Firmware Security Testing Methodology =
 [[File:OWASP_Project_Header.jpg|link=]]
 == Firmware Security Testing Methodology ==
 The Firmware Security Testing Methodology (FSTM) is composed of nine stages tailored to enable security researchers, software developers, consultants, hobbyists, and Information Security professionals with conducting firmware security assessments.
@@ Line 1,095: / Line 1,141: @@
 |-
 |2. Obtaining  firmware
-|Attain  firmware using one or more of the proposed methods listed
+|Attain firmware using one or more of the proposed methods listed
 |-
 |3. Analyzing firmware
@@ Line 1,101: / Line 1,147: @@
 |-
 |4. Extracting  the filesystem
-|Carve  filesystem contents from the target firmware
+|Carve filesystem contents from the target firmware
 |-
 |5. Analyzing filesystem contents
@@ Line 1,107: / Line 1,153: @@
 |-
 |6. Emulating  firmware
-|Emulate  firmware files and components
+|Emulate firmware files and components
 |-
 |7. Dynamic analysis
@@ Line 1,113: / Line 1,159: @@
 |-
 |8. Runtime  analysis
-|Analyze  compiled binaries during device runtime
+|Analyze compiled binaries during device runtime
 |-
 |9. Binary Exploitation
 |Exploit identified vulnerabilities discovered in previous  stages to attain root and/or code execution
-|}
+|}The full methodology release can be downloaded via the following TBD.
 The full{{Social Media Links}}
 | style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |
-== What is the Firmware Analysis Project? ==
+== What is the Firmware Security Testing Methodology ==
-The Firmware Analysis Project provides:
+The Firmware Security Testing Methodology Project provides:
-* Security testing guidance for vulnerabilities in the "Device Firmware" attack surface
+*Attack walkthroughs
-* Steps for extracting file systems from various firmware files
+*Tool usage examples
-* Guidance on searching a file systems for sensitive of interesting data
+*Screenshots
-* Information on static analysis of firmware contents
+*Companion virtual machine preloaded with tools (EmbedOS) - <nowiki>https://github.com/scriptingxss/EmbedOS</nowiki>
 == Project Leaders ==
-* Craig Smith
+* Aaron Guzman
-* [[OWASP_Mobile_Security_Project|OWASP Mobile Security]]
+== Quick Download ==
-* [[OWASP_Top_Ten_Project|OWASP Web Top 10]]
+* TBD
 |}

@@ Line 10: / Line 10: @@
 ''The OWASP Internet of Things Project is designed to help manufacturers, developers, and consumers better understand the security issues associated with the Internet of Things, and to enable users in any context to make better security decisions when building, deploying, or assessing IoT technologies''.
-The project looks to define a structure for various IoT sub-projects such as Attack Surface Areas, Testing Guides and Top Vulnerabilities.
+The project looks to define a structure for various IoT sub-projects such as Attack Surface Areas, Testing Guides, Tools, and Top Vulnerabilities.
 ==Updated!==
@@ Line 114: / Line 114: @@
 == Quick Download ==
 [https://www.owasp.org/images/1/1c/OWASP-IoT-Top-10-2018-final.pdf OWASP IoT Top Ten 2018]
 [https://www.owasp.org/images/3/36/IoTTestingMethodology.pdf IoT Attack Surface Mapping DEFCON 23]
@@ Line 122: / Line 120: @@
 [https://www.owasp.org/images/7/71/Internet_of_Things_Top_Ten_2014-OWASP.pdf OWASP IoT Top Ten 2014 PDF]
 [https://www.owasp.org/images/b/bd/OWASP-IoT.pptx OWASP IoT Project Overview]
@@ Line 133: / Line 125: @@
 == News and Events ==
 * OWASP [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoTGoat IoTGoat Project] underway
 * IoT ASVS and Testing Guide set to kick off in 2019
 * Added a [https://owasp-iot-security.slack.com/ Slack channel]

@@ Line 230: / Line 230: @@
 |}
 = IoT Attack Surface Areas =
@@ Line 1,212: / Line 1,303: @@
 ==News and Events==
 *Coming Soon
 |}<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;"></div>

← Older revision		Revision as of 23:17, 17 September 2019
Line 997:		Line 997:
	\|}		\|}

		+	=== Firmware Security Testing Methodology ===
	{{Social Media Links}}		{{Social Media Links}}

@@ Line 986: / Line 986: @@
 * [http://www.binaryanalysis.org/en/home Binary Analysis Tool]
 * [https://github.com/firmadyne/firmadyne Firmadyne]
 |-
+|
@@ Line 991: / Line 993: @@
+|
 * [https://github.com/praetorian-inc/DVRF Damn Vulnerable Router Firmware]
 |-
 |}