IoT, Embedded and Hardware Security
Update and OTA Security
We review your device's update mechanism. We test whether a modified update can be installed on the device.
What it is
An over-the-air (OTA) update may be the only way to fix a vulnerability in the field. If the update mechanism is weak, it can allow code to be loaded onto the device. The review covers whether the update package signature is verified and whether rollback to an older version is prevented. The permissions of the update server are also assessed.
Scope
- Testing signature and integrity verification of the update package
- Rejection of modified packages or those intended for another device
- Prevention of rollback to an old and vulnerable version
- Reviewing the permissions of the update server and distribution infrastructure
- Secure transport of the update over the network
The need
When organizations need it
- Before over-the-air updates are implemented on your devices.
- When your product will enter the EU market and you need to demonstrate secure update distribution.
- When asked whether the entire fleet would be affected if an update server is compromised.
Method
How we work
-
Review
We follow the update process from package creation to installation on the device.
-
Testing
We test in a controlled environment whether the device rejects modified and old-version packages.
-
Server
We assess the permissions of the update server and the impact of a single compromise.
Outcome
What you have at the end
You know your update mechanism's status on signature verification, rollback protection, and server permissions. Gaps are listed with their potential impact.
Frequently asked questions
We use signed updates. Is that sufficient?
A signature is important but not sufficient alone. You must also test that the device verifies the signature and blocks rollback to an older signed version.
Is there a baseline standard for consumer IoT?
ETSI EN 303 645 requires the device to verify the authenticity and integrity of updates delivered over the network. We conduct the review according to this standard.
IoT, Embedded and Hardware Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting