97 Things Every Application Security Professional Should Know

Chapter 94. Application Identity for Embedded Systems

Jason Sinchak

When embedded system software is shipped, it is shipped in an out-of-the-box form that is the same for all users or customers. Identities used to authenticate to user interfaces or the platform are typically managed locally and uniquely for the system. As a result, the user or customer must be provided a mechanism for managing these identities through the main application interface or an external component.

As embedded systems can be physically accessed by a threat actor, such as through purchasing on the aftermarket, reverse engineering is often performed to gain access to the firmware. Once in the hands of a threat actor, it can discover critical mistakes such as hardcoded passwords, usernames, tokens, or keys in firmware. Globally default and hardcoded sensitive data will eventually be identified and published. Once published, that information will impact the entire fleet, all customers, or any device running the same firmware.

Embedded systems should avoid storing secrets in a hardcoded or globally default fashion. In addition, they should provide features that enable the separation of user accounts for user interface, internal management, console access, remote management, etc.

Where possible, service accounts should be avoided, and instead service-like features should be afforded as privileges for various ...