Top 10 2014-I9 Insecure Software/Firmware - Revision history

Yunsoul at 06:57, 5 February 2016

2016-02-05T06:57:11Z

2015-12-01T23:02:58Z

2015-08-18T00:12:58Z

2015-03-01T21:34:19Z

2015-02-09T23:04:35Z

2015-02-04T23:27:53Z

2015-02-04T23:16:52Z

2015-02-04T23:13:54Z

2015-02-04T23:09:51Z

2015-02-04T23:08:09Z

@@ Line 33: / Line 33: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Software/Firmware?|position=right|year=2013|language=en}}
 Securing software/firmware require:
-# Ensuring the device has the ability to update (very important)
+# Ensuring the device has the ability to update (very important, need secure update mechanism)
 # Ensuring the update file is encrypted using accepted encryption methods
 # Ensuring the update file is transmitted via an encrypted connection
@@ Line 39: / Line 39: @@
 # Ensuring the update is signed and verified before allowing the update to be uploaded and applied
 # Ensuring the update server is secure
 Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]

← Older revision		Revision as of 23:02, 1 December 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=~~Top_IoT_Vulnerabilities~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

← Older revision		Revision as of 00:12, 18 August 2015
Line 1:		Line 1:
−	<center>[https://www.owasp.org/index.php/~~OWASP_Internet_of_Things_Top_Ten_Project~~#tab=~~OWASP_Internet_of_Things_Top_10_for_2014~~ Back To The Internet of Things Top 10]</center>	+	<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_IoT_Vulnerabilities Back To The Internet of Things Top 10]</center>

	{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}		{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2013\|language=en}}

@@ Line 36: / Line 36: @@
 # Ensuring the update file is encrypted using accepted encryption methods
 # Ensuring the update file is transmitted via an encrypted connection
-# Ensuring the update file does not contain sensitive data
+# Ensuring the update file does not expose sensitive data
 # Ensuring the update is signed and verified before allowing the update to be uploaded and applied
 # Ensuring the update server is secure

@@ Line 39: / Line 39: @@
 # Ensuring the update is signed and verified before allowing the update to be uploaded and applied
 # Ensuring the update server is secure
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 '''Scenario #1:''' Update file is transmitted via HTTP.

@@ Line 4: / Line 4: @@
 {{Top_10:SummaryTableTemplate|exploitability=3|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
-      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the device and/or the network the device resides on. Also consider anyone who could gain access to the update host.
+      <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the device and/or the network the device resides on. Also consider anyone who could gain access to the update server.
 </td>

@@ Line 28: / Line 28: @@
 * Reviewing the production file update to ensure it is properly signed
 * Reviewing the communication method used to transmit the update
-* Reviewing the cloud update host to ensure transport encryption methods are up to date and properly configured and that the host itself is not vulnerable
+* Reviewing the cloud update server to ensure transport encryption methods are up to date and properly configured and that the server itself is not vulnerable
 * Reviewing the device for proper validation of signed update files
@@ Line 34: / Line 34: @@
 Securing software/firmware require:
 # Ensuring the device has the ability to update (very important)
-# Ensuring the update file is encrypted using accepted encryption methods.
+# Ensuring the update file is encrypted using accepted encryption methods
-# Ensuring the update file is transmitted via an encrypted connection.
+# Ensuring the update file is transmitted via an encrypted connection
-# Ensuring the update file does not contain sensitive data.
+# Ensuring the update file does not contain sensitive data
-# Ensuring the update is signed and verified before allowing the update to be uploaded and applied.
+# Ensuring the update is signed and verified before allowing the update to be uploaded and applied
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 '''Scenario #1:''' Update file is transmitted via HTTP.

@@ Line 23: / Line 23: @@
 {{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Software/Firmware Secure?|position=firstLeft|year=2013|language=en}}
 * Note - It is very important that devices first and foremost have the ability to update and perform updates regularly.
-The simplest way to check for insecure software/firmware updates is to review the update file itself and also the communication method used to transmit those updates. The update file should also be reviewed for exposure of any sensitive data in human readable format by someone using a hex edit tool.
+Checking for insecure software/firmware updates include:
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Secure My Software/Firmware?|position=right|year=2013|language=en}}