PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Engineer Secure Things: Past Mistakes and Future Advice

bishopfox.com | blog | #firmware | #iot | #embedded-security | #code-signing | #secure-design
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The recurring engineering mistakes behind insecure IoT products, starting with unvalidated firmware updates (see the TrackingPoint rifle), plus advice like root of trust and code signing.
Published
Collected

Related coverage

blog · netspi.com
Rust’s Role in Embedded Security
Rust improves memory safety in embedded systems, eliminating entire vulnerability classes, but logic, hardware, and cryptographic flaws still demand rigorous security testing.
blog · blog.viettelcybersecurity.com
Lỗ hổng điều khiển các thiết bị SmartHome Lumi
Researcher analyzes Lumi smart home devices, finding hardcoded MQTT credentials in firmware and weak controls that let attackers manipulate lights and locks via local Wi-Fi or the cloud.
blog · blog.viettelcybersecurity.com
Research IOT - Analyze Bootloader - notBootSecure
A researcher reverse engineers an encrypted Hikvision camera firmware, using UART access to dump the bootloader and recover the decryption key, a practical guide to IoT firmware extraction.
research · eshard.com
eShard and HandsOnTraining: Security Training for Embedded Systems
Revolutionizing Security Training for Embedded Systems: eShard's new partnership with HandsOnTraining takes training to new heights.
blog · bishopfox.com
(In)Secure by Design
Starting from the OWASP Top 10's new Insecure Design category, this post explains why issues like injection keep recurring and how secure design patterns and threat modeling address root causes.
blog · bishopfox.com
You're (Still) Doing IoT RNG
A follow-up on systemic RNG misuse in IoT devices, tracking how major IoT operating systems have progressed toward centralized CSPRNG subsystems since the original DEF CON 29 research.
Back