This presentation discusses defense-in-depth strategies for embedded devices. It outlines various attack vectors at different levels of an embedded device stack, from hardware components to firmware to applications. It then describes corresponding countermeasures to protect against each attack vector. The attack vectors include device reconnaissance, tampering with hardware components, exploiting debug interfaces, firmware reverse engineering, software flaws, and application vulnerabilities. The countermeasures center around techniques like obfuscation, encryption, authentication, exception handling, updates, and using secure protocols. The presentation aims to help secure embedded devices against hacks and protect their integrity.

1. Defense-in-Depth
for
Embedded Devices
Jiggyasu Sharma

2. DISCLAIMER
The opinions and thoughts presented during the course
of this presentation are my own and do not reflect the
views or positions of my employer.
2

3. #whoami
• A security evangelist
• Working with Resideo (Honeywell Homes) – Product Security
• Contributor towards security communities; IS-RA, null, CysInfo,
h1hakz, ISC2.
• Speaker at security conferences RSA, c0c0n, IoT day etc.
• Having security certifications from Offensive Security, SANS and EC-
Council
• Interested in IoT, ICS and SCADA Security
3

4. Agenda
• To know about embedded devices attack surface
• And to protect them against hack

5. How is Embedded Device look like?

6. Embedded Device Stack
• Attack Vectors
• Device reconnaissance
• Web Search Engines
• FCCID
• Open Source Libraries
• Tempering the Device
• Chip/components Identification
• Datasheets
• Pin-out Probes
Hardware Components
Hardware Protocols
Boot/RootFS
Application/Platform
Kernel
Bootloader / Firmware
• Countermeasures
• To protect the device IP
• Service/User Manuals
• Test Documents on FCCID
• Securing Open source Libraries
• Chip morphing
• Temper Protection

7. Embedded Device Stack
• Attack Vectors
• JTAG
• UART
• SPI
• I2C
• CANBUS
• BDS
Hardware Components
Hardware Protocols
Boot/RootFS
Kernel
Bootloader / Firmware
Application/Platform • Countermeasures
• Obfuscation of pin-outs
• Remove the Traces
• Blow Fuse in Pin-Outs
• Encryption/Authentication
• Key Token
• Power Toggle
• Read out Protections
• Randomizing Probes
• Set option Bits
• Validating Assembly
• CRC/ HASH
• Custom Baud Rate

8. Embedded Device Stack
• Attack Vectors
• U-Boot
• RootFS
• Firmware Signature
• Root Certificates
Hardware Components
Hardware Protocols
Boot/RootFS
Kernel
Bootloader / Firmware
Application/Platform • Countermeasures
• Run Time key Generation
• Safe Zones
• Using Secondary memory
• Secure Boot enable
• Authenticated RootFS
• Obfuscated Signatures

9. Embedded Device Stack
• Attack Vectors
• Memory Leakage
• Stack overflow
• Buffer Overflow
• Unmanaged code
• Kernel Crash
• Unhandled exception
• Side Channels Faults
• Power glitching
• NAND/Clock glitching
• ThermalHardware Components
Hardware Protocols
Boot/RootFS
Kernel
Bootloader / Firmware
Application/Platform
• Countermeasures
• Memory management
• Exception handling
• Fixing Zero days
• Crash reporting/Self Healing
• Circuit Power Handling
• Glitch detectors
• Brownout detectors
• Lockstep cores
• Asynchronous internal clock with
dummy cycles
• Internal Oscillators
• Halt on invalid instruction execution
• Lock down unnecessary diagnostic
signals
• Mutable codes

10. Embedded Device Stack
• Attack Vectors
• Firmware Emulation
• Reverse Engineering
• Compression/Encryption
• Hardcoded Credentials/Keys/Certificates
• PII
• Key Generation Algo
• Backdoors
Hardware Components
Hardware Protocols
Boot/RootFS
Kernel
Bootloader / Firmware
Application/Platform
• Countermeasures
• Encryption
• Compression
• Obfuscation
• Encoding
• Certificates
• Signatures
• Run time Keys
• Run time protection
• Remove Backdoors
• Randomized functions
• Secure APIs/Libraries
• Integral Updates
• Complex key generations
• Root of trust / Chain of Trust
• Avoid Secondary memory

11. Embedded Device Stack
• Attack Vectors
• Application Flaws
• COAP
• MQTT
Hardware Components
Hardware Protocols
Boot/RootFS
Kernel
Bootloader / Firmware
Application/Platform • Countermeasures
• Secure API implementation
• Auth Mechanism
• Reliable node detection
• Active search engine scans
• Secure 3rd party libraries
• TLS

12. Take Away

13. Questions???
Connect to me:
/jiggyasu-sharma
/jiggyasu.sharma
/jiggyasu_sharma
jiggyasu.sharma@gmail.com
13
Thank you धन्यवाद्