Embedded Systems

Embedded systems are microcomputer technologies directly incorporated into mechanical, electrical, hydraulic, or other kinds of devices. These microcontrollers replace or augment control systems such as mechanical thermostats, regulators, or load-balancing mechanisms. They can provide a broader range of control functions, improve the overall system's reliability and performance, and gather monitoring data and upload it to off-board systems for analysis, trending, and other uses. This embedding of technology can be found in automobiles, airplanes, consumer appliances, medical devices, and security systems. With simple operating systems (OSs) and relatively low power requirements, embedded systems are often less expensive, easier to maintain, and more precise than their analog predecessors.

Nevertheless, embedded systems present a substantial operational risk. If they fail to perform their function for any reason, the system they support may become inoperable. In many environments, this level of risk is unacceptable. Applications with safety-of-life requirements quite often require some level of control redundancy to achieve the operational reliability necessary to achieve safety requirements.

In many embedded systems, the code base is maintained in read-only memory and is not updatable. In other cases, the firmware can be updated, either remotely or locally, depending on the system's communications capabilities. Regardless, maintaining the code of embedded systems presents unique challenges in risk assessment, code validation, distribution across the installed base of systems, and deployment.

Security professionals should be aware that the dividing line between industrial control systems (ICSs) and embedded systems is somewhat blurred. A motor-driven valve may have an analog electrical control signal or a digital one; in either case, its onboard control circuitry may or may not contain a digital microcontroller. Many ICSs contain embedded systems as part of both their control processes and the systems that the ICS controls and monitors. The ICS itself may be embedded into a device.

Vulnerabilities of embedded systems include:

• Programming errors. Poor coding practices are a primary cause of weaknesses in embedded systems documented in the National Vulnerability Database. Failed input validation, improper buffer management, and poor memory management practices have been well documented. These challenges may occur for many reasons, including the limitations of the embedded OS or poor coding practices within the application.
• Web-based vulnerability. Many embedded devices have a web-based management interface through which they can be configured and updated. However, due to poor vulnerability management practices and the limitations of the embedded environment, the embedded web applications on those devices are often left exposed to known weaknesses.
• Reverse engineering. Often, the firmware can be analyzed through special techniques, exposing the intellectual property of the software or allowing the attacker to identify other weaknesses in the source code.
• Malware. The Stuxnet virus highlighted the capabilities of sophisticated attackers in targeting and compromising embedded systems. Because these systems are often used to support complex industrial processes requiring precise control, they are lucrative targets when an attacker seeks to disrupt the business process.
• Eavesdropping. Monitoring of communication streams by attackers is a well-established form of compromise. Whether the attacker seeks to exploit the information by observing the communications flow or intends to execute replay attacks against the target, the effects can be devastating. Coupled with weak or nonexistent cryptographic protections over

• Weak access control or authentication. Many devices use weak default passwords, often with hard-coded credentials, that give backdoor access to the device, ostensibly to simplify the

vendor's access for support.

• Poor cryptography practices. Poor cryptographic algorithms and flawed implantation can often be exploited to compromise the device. Algorithms used to support access controls are particularly weak, often relying on legacy methods of authentication.

communications, an attacker can manipulate the transactions in the environment, often without detection.

Mitigations for embedded systems include:

• Risk assessment. Integrating embedded systems into the organization's risk assessment framework is essential. Without comprehensive inventories of the systems in place and evaluating the level of risk that the system poses to the environment, it is virtually impossible to develop comprehensive plans to protect the environment.
• Patching and updating. Where possible (given the limitations of vendor support and the hardware itself, maintaining the embedded systems' code base should be performed consistently with the organization's vulnerability management standards.
• Secure coding techniques. Use of proper cryptographic algorithms, static and dynamic code analysis, and obfuscation techniques in the deployment of code may reduce the risk of some of the common forms of compromise described above.
• Implementing third-party risk management practices. Embedded systems are often part of vendor products integrated into an organization's environment. Consequently, evaluating a third party's development and software management practices must inform the organization's risk assessment processes to ensure a proper assessment of operational risk.