Difference between revisions of "OWASP Embedded Application Security"

Revision as of 02:41, 4 January 2017

Main
Embedded Best Practices
Table of Contents
Embedded Device Firmware Analysis Tools
Roadmap

OWASP Embedded Application Security Project

Each year, embedded software within enterprise and consumer devices continue to be on the rise. Given the publicity with IoT and more devices becoming network connected, it is essential to create secure coding guidelines for embedded software. Embedded Application Security is often not thought of as a high priority for embedded devices such as Routers, Managed Switches, Medical Devices, IoT devices, and ATM Kiosks by device manufactures. There are many challenges in the embedded field including ODM supply chain, limited memory, a small stack, and the challenge of pushing firmware updates securely to an endpoint. The goal of this project is to create a list of best practices, provide practical guidance to embedded developers, and to draw on the resources that OWASP already has to bring application security expertise to the embedded world.

Mailing List

Embedded Sec Mailing List

Project Leaders

Aaron Guzman @
Alex Lafrenz @

Related Projects

News and Events

[18 July 2016] New Project Template

In Print

We will be releasing a user guide soon!

Classifications

The Working Document can be found here (Google Docs) https://docs.google.com/document/d/1NxpVCeiglY1wHhmw7U-e9jnHgd-jQI-Y6sbdeKzUpQE/edit?usp=sharing

Draft-The items below are subject to change

Introduction

Release Notes

Risk Involved

Top 10

E1 – Memory Protections

E2 – Injection

E3 – Firmware Updates and Cryptographic Signatures

E4 – Secrets and Keys

E5 – Disposal of Temporary Files and Buffers

E6 – Embedded Framework Hardening

E7 – Debug Code and Interfaces

E8 – Transport Layer Security

E9 – Data collection and Storage

E10 – Components and Third Party Code

Note on Hardware

Get Involved

Angr - [1]
Firmadyne [2]
Firmwalker [3]
Binary Analysis [4]
Flaw Finder [5]
IDA Pro (supports ARM / MIPS)
Radare2 [6]
GDB
Binwalk [7]
Firmware-mod-toolkit [8]
Capstone framework [9]
Shikra [10]
JTagulator [11]
UART cables
JTAG Adapters (JLINK)
BusPirate
BusBlaster
CPLDs (in lieu of FPGAs)
Oscilloscopes
Multimeter (Ammeter, Voltmeter, etc)
Logic Analyzers for SPI [12]
OpenOCD
GreatFET [13]

2016-2017 Roadmap

Curate a list of embedded secure coding best practices.
Create a Top 10 Embedded Application Security list.
Participate in PR-related activities to involve the embedded community at large.
Contribute to ASVS with embedded security principles

Feel free to join the mailing list and contact the Project leader if you feel you can contribute.

@@ Line 6: / Line 6: @@
 ==OWASP Embedded Application Security Project ==
-Each year, the number of enterprise and consumer devices with embedded software are on the rise. Given the publicity with IoT and more devices becoming network connected, it is essential to create secure coding guidelines for embedded software. Embedded Application Security is not often a high priority for embedded devices such as Routers, Managed Switches, IoT devices, and even ATM Kiosks. There are many challenges in the embedded field including ODM supply chain, limited memory, a small stack, and the challenge of pushing firmware updates securely to an endpoint.
+Each year, embedded software within enterprise and consumer devices continue to be on the rise. Given the publicity with IoT and more devices becoming network connected, it is essential to create secure coding guidelines for embedded software. Embedded Application Security is often not thought of as a high priority for embedded devices such as Routers, Managed Switches, Medical Devices, IoT devices, and ATM Kiosks by device manufactures. There are many challenges in the embedded field including ODM supply chain, limited memory, a small stack, and the challenge of pushing firmware updates securely to an endpoint.
 The goal of this project is to create a list of best practices, provide practical guidance to embedded developers, and to draw on the resources that OWASP already has to bring application security expertise to the embedded world.