97 Things Every Application Security Professional Should Know

Chapter 93. Platform Security for Embedded Systems

Jason Sinchak

Most embedded systems are devices that contain hardware from the era in which it was designed; regardless of how cutting edge it may be at design, it will eventually become legacy. Unlike applications designed to run on nonembedded systems, these applications cannot be moved; they live forever on this hardware. As a result, applications developed for embedded systems often have responsibility for the entire platform yet are constrained by the hardware. Therefore, the developers need to understand and apply other security controls to pair with AppSec practices.

Maintaining Data Security

As embedded systems can be physically accessed by a threat actor, such as through purchasing on the aftermarket, reverse engineering is often performed to gain access to the firmware. Due to the physical risks associated with storing data on embedded systems, applications must avoid critical mistakes such as hardcoding passwords, usernames, tokens, or keys in firmware. Globally default and hardcoded sensitive data will eventually be identified and published. Once published, that information will impact the entire fleet—all customers, or any device running the same firmware. Developers should avoid authenticating users or components through hardcoded information that is globally the same across products. System designers should enable ...