Embedded Device Security Testing at Every Stage of Development

FireEye Mandiant is seeing more embedded devices out in the world than ever before. These new technologies—what some people refer to as the Internet of Things (IOT)—bring many benefits, but also create a larger attack surface for threat actors across the globe.

Manufacturers of these embedded devices must consider the highest level of protection and in turn think about critical security factors related to these devices across their development lifecycle. Any vulnerabilities identified can lead to damaging compromise of their customers’ personal and professional assets, and reputational damage for the manufacturer itself.

So, what can organizations and manufacturers do to ensure their devices are secure? Mandiant Embedded Device Assessments can help by testing the security posture of these devices across the development lifecycle, but more on that later in the post. First, let’s have a look at what we mean by ‘embedded device.’

What is an Embedded Device?

Think of embedded devices as black box devices with limited monitoring and alerting capabilities. Examples include networking appliances, GPS transponders, smart phones, IP cameras, television set-top boxes, entertainment systems and drones. These devices are used by everyone, from consumers in their homes to large businesses with multiple offices and remote workers.

While general-use computers allow for a broad variety of strategies to address operating system security using various security management software tools, embedded devices do not follow that same suit and are especially vulnerable because there is often no mechanism available to add these additional layers of continuous monitoring and security.

The interfaces built into embedded devices are particularly vulnerable. An attacker can leverage these interfaces— often using well-known standards such as Ethernet, Bluetooth, Zigbee, USB, and JTAG (just to name a few)—to create a foothold and gain access to perform any number of actions, with the objective to damage device effectiveness and manipulate its trusted status within a larger system.

No Industry Left Behind

Embedded devices do not discriminate against any industry sectors; in fact, they’re found with increasing frequency across all of them. Some highly affected areas are:

• Healthcare: Hospitals are increasingly using devices to monitor vitals remotely. Medical implants are becoming connected to the outside world to monitor and modify their operation. Healthcare providers are also performing medical procedures with full or partial robotic assistance more than ever before.
• Automotive: Outside of the industrial control systems used in auto manufacturing facilities, automobiles are becoming progressively connected. Modern infotainment broadcast units (in-car entertainment) often contain several cellular modems, a wireless hotspot and connections to the Car Area Network (CAN) to offer seamless remote access. Additionally, first responder vehicles now contain a multitude of devices reporting their location and other critical data for enhanced patient care.
• Enterprise Networking: Critical vulnerabilities are regularly discovered in even the most widely used enterprise-grade switches and routers. Manufacturers of these devices typically provide ways to manage the necessary software updates, though not all devices can be administered in the same manner. Specialized devices for remote work access or those that provide public services are at great risk to physical and network-based tampering, and in-turn require a more rigorous analysis before deployment.
• Consumer Electronics: Smart in-home devices such as smart thermostats and voice-controlled assistants are connected to the Internet and to each other. This connectivity is achieved through both wired and wireless networking protocols, including radio protocols that require specialized knowledge to monitor and test respective device signals. Consumer devices are notorious for containing serious flaws, and these devices often find their way into an organization's enterprise network in order to facilitate connectivity to supporting applications or cloud infrastructure.

An Effective Approach to Embedded Device Assessments

The most effective approach in securing an embedded device is to perform a proactive assessment across the production lifecycle (Figure 1). This will reveal systematic flaws in both the device’s development and operating processes and enable manufacturers to implement improved security methods prior to broader market launch.

Figure 1: Security objectives across device lifecycle stages

The Mandiant Embedded Device Assessment does just that, helping manufacturers discover vulnerabilities in their devices throughout development and improve the product’s overall security against cyber attacks.

A successful embedded device assessment should address the following focus areas:

• Identify and mitigate hidden threats to prevent developmental security and privacy flaws
• Include risk analysis and threat modeling based on the deployment scenario of the specific embedded device, not a general and/or similar appliance
• Test and analyze firmware and component services of the specific embedded device
• Analyze all hardware interfaces, wire protocols, running services and microprocessor features
• Perform penetration testing against any cloud services or mobile applications used to connect or control the device
• Provide feedback on best practices for software development or deployment when applicable

Mandiant experts use this approach and take it one step further by decoding a threat model for the device’s specific deployment setting, which helps to uncover potential real-world risks that could result in a compromise of that device. These findings are then used to develop tools that demonstrate the severity of discovered vulnerabilities, such as a backdoor that could allow unlimited access to the device. By understanding all the potential security issues that can arise during development, the manufacturer can hope to avoid introducing or reintroducing them again in the future.

Organizations and consumers are more invested in their security than ever before, which is precisely why manufacturers of embedded devices need to keep security in mind at every stage of development. 

Learn more about Mandiant Embedded Device Assessments.