1 1 00:00:00,360 --> 00:00:03,060 Embedded system vulnerabilities. 2 2 00:00:03,060 --> 00:00:05,010 In this lesson, we're going to start talking 3 3 00:00:05,010 --> 00:00:07,320 about some embedded system vulnerabilities, 4 4 00:00:07,320 --> 00:00:08,430 because we talked about the fact 5 5 00:00:08,430 --> 00:00:10,530 that a lot of these devices that we connect to the internet 6 6 00:00:10,530 --> 00:00:12,810 as part of the internet of things at large, 7 7 00:00:12,810 --> 00:00:14,640 do have embedded operating systems, 8 8 00:00:14,640 --> 00:00:17,400 like Linux or Android or other things like that. 9 9 00:00:17,400 --> 00:00:19,290 Now, when we talk about an embedded system, 10 10 00:00:19,290 --> 00:00:21,240 this is a computer system that is designed 11 11 00:00:21,240 --> 00:00:24,660 to perform a specific and dedicated function. 12 12 00:00:24,660 --> 00:00:26,940 Now, oftentimes when we talk about an embedded system, 13 13 00:00:26,940 --> 00:00:30,120 we're talking about things more in the manufacturing space 14 14 00:00:30,120 --> 00:00:31,860 or automation space. 15 15 00:00:31,860 --> 00:00:35,190 So we might have a microcontroller in a medical drip system, 16 16 00:00:35,190 --> 00:00:37,830 that it has one job, it's to measure the amount of volume 17 17 00:00:37,830 --> 00:00:41,340 of fluid that goes through that machine and into your IV 18 18 00:00:41,340 --> 00:00:43,200 so you can give the patient what they need. 19 19 00:00:43,200 --> 00:00:45,360 You might have another one for a control system 20 20 00:00:45,360 --> 00:00:46,710 at a water treatment plant 21 21 00:00:46,710 --> 00:00:48,150 and its responsibility is to make sure 22 22 00:00:48,150 --> 00:00:50,580 that water is flowing through at a certain rate 23 23 00:00:50,580 --> 00:00:52,140 and they're going to open or close valves 24 24 00:00:52,140 --> 00:00:54,390 to make sure we maintain that amount of flow 25 25 00:00:54,390 --> 00:00:55,620 through the system. 26 26 00:00:55,620 --> 00:00:57,390 This is the idea of an embedded system 27 27 00:00:57,390 --> 00:00:59,520 and it can be a very, very simple device 28 28 00:00:59,520 --> 00:01:01,290 or it can be fully complex 29 29 00:01:01,290 --> 00:01:03,000 and have a full operating system, 30 30 00:01:03,000 --> 00:01:04,980 like Linux or Android being used 31 31 00:01:04,980 --> 00:01:06,570 to run these type of systems. 32 32 00:01:06,570 --> 00:01:08,040 It just depends. 33 33 00:01:08,040 --> 00:01:09,450 Now, in this particular lesson, 34 34 00:01:09,450 --> 00:01:12,390 I'm going to focus more on the specific embedded systems 35 35 00:01:12,390 --> 00:01:13,830 that have a single function 36 36 00:01:13,830 --> 00:01:16,110 and they have their own dedicated operating system 37 37 00:01:16,110 --> 00:01:18,780 or microprocessors to do that function. 38 38 00:01:18,780 --> 00:01:21,630 For instance, at my house, I have a smart meter. 39 39 00:01:21,630 --> 00:01:23,610 So if I go out to my side of my house, 40 40 00:01:23,610 --> 00:01:25,230 I can look at the electric meter on my house 41 41 00:01:25,230 --> 00:01:28,620 and it'll tell me how many kilowatts per hour I am using 42 42 00:01:28,620 --> 00:01:30,720 and how much I've used over time. 43 43 00:01:30,720 --> 00:01:33,570 Now, this information is connected to the internet 44 44 00:01:33,570 --> 00:01:35,640 so that the power company doesn't have to send somebody 45 45 00:01:35,640 --> 00:01:38,130 to my house to read this meter once a month. 46 46 00:01:38,130 --> 00:01:40,410 Instead, it's all done electronically now. 47 47 00:01:40,410 --> 00:01:42,300 They do this by using cellular modems 48 48 00:01:42,300 --> 00:01:44,130 and it connects through the cellular network, 49 49 00:01:44,130 --> 00:01:45,390 back over the internet, 50 50 00:01:45,390 --> 00:01:47,220 to their headquarters and to their servers 51 51 00:01:47,220 --> 00:01:49,080 to feed in the data of what we've used 52 52 00:01:49,080 --> 00:01:50,310 for power consumption. 53 53 00:01:50,310 --> 00:01:51,450 If you look at your meter at your house, 54 54 00:01:51,450 --> 00:01:53,880 you probably have something that looks pretty similar. 55 55 00:01:53,880 --> 00:01:55,680 Now, these types of embedded systems 56 56 00:01:55,680 --> 00:01:57,660 are considered static environments 57 57 00:01:57,660 --> 00:02:00,210 where frequent changes are not made or allowed. 58 58 00:02:00,210 --> 00:02:02,280 So when's the last time you upgraded the software 59 59 00:02:02,280 --> 00:02:03,660 on your electric meter, for instance? 60 60 00:02:03,660 --> 00:02:04,890 You probably never have, 61 61 00:02:04,890 --> 00:02:06,810 and the power company probably doesn't do it 62 62 00:02:06,810 --> 00:02:07,800 very frequently either. 63 63 00:02:07,800 --> 00:02:09,870 That's the idea of these embedded systems. 64 64 00:02:09,870 --> 00:02:11,580 They are a very stripped down system 65 65 00:02:11,580 --> 00:02:14,640 that is made to do one purpose and one purpose only. 66 66 00:02:14,640 --> 00:02:17,190 And by doing that, that helps them become more secure 67 67 00:02:17,190 --> 00:02:19,170 because they don't have a lot of extra code. 68 68 00:02:19,170 --> 00:02:21,300 But if that original code wasn't made in place 69 69 00:02:21,300 --> 00:02:23,850 in a good state, it makes it hard to do updates, 70 70 00:02:23,850 --> 00:02:25,290 because these things aren't built 71 71 00:02:25,290 --> 00:02:27,540 to be able to get frequent software updates. 72 72 00:02:27,540 --> 00:02:29,760 Because of this, embedded systems often have 73 73 00:02:29,760 --> 00:02:31,440 very little support for identifying 74 74 00:02:31,440 --> 00:02:33,480 and correcting security issues. 75 75 00:02:33,480 --> 00:02:34,800 You can't call up the power company 76 76 00:02:34,800 --> 00:02:36,540 and tell them to come secure your meter. 77 77 00:02:36,540 --> 00:02:38,730 That's just not part of what they're going to do for you. 78 78 00:02:38,730 --> 00:02:40,050 They're going to do it the way they want to do it 79 79 00:02:40,050 --> 00:02:41,520 because it's their device. 80 80 00:02:41,520 --> 00:02:42,840 And often, if you have an embedded system 81 81 00:02:42,840 --> 00:02:44,610 inside your factory or inside your plant, 82 82 00:02:44,610 --> 00:02:46,410 if you are in a manufacturing area, 83 83 00:02:46,410 --> 00:02:48,900 you're going to have limited support from that manufacturer 84 84 00:02:48,900 --> 00:02:50,220 and so this is an area 85 85 00:02:50,220 --> 00:02:51,720 where you really want to get all these devices 86 86 00:02:51,720 --> 00:02:53,160 onto a separate network 87 87 00:02:53,160 --> 00:02:55,830 and not have them connected back to the internet at large 88 88 00:02:55,830 --> 00:02:58,680 or this could be a big area of vulnerability for you. 89 89 00:02:58,680 --> 00:03:00,090 Now, when we talk about embedded systems, 90 90 00:03:00,090 --> 00:03:01,920 there's a term called PLC, 91 91 00:03:01,920 --> 00:03:04,710 which is a programmable logic controller. 92 92 00:03:04,710 --> 00:03:06,990 This is a type of computer that's designed for deployment 93 93 00:03:06,990 --> 00:03:09,060 in industrial or outdoor setting 94 94 00:03:09,060 --> 00:03:11,640 and it can automate and monitor mechanical systems. 95 95 00:03:11,640 --> 00:03:13,440 Now, when you think about a PLC, 96 96 00:03:13,440 --> 00:03:15,390 I want you to think of something like manufacturing 97 97 00:03:15,390 --> 00:03:17,100 that's going to open or shut a valve 98 98 00:03:17,100 --> 00:03:19,050 to let more or less water come in. 99 99 00:03:19,050 --> 00:03:20,820 That's the idea of a PLC. 100 100 00:03:20,820 --> 00:03:23,460 It is a programmable logic controller. 101 101 00:03:23,460 --> 00:03:25,680 Now, these PLCs run on firmware, 102 102 00:03:25,680 --> 00:03:27,990 because again, these are embedded systems. 103 103 00:03:27,990 --> 00:03:30,630 So the firmware, which is software on a chip 104 104 00:03:30,630 --> 00:03:31,772 can be patched and reprogrammed 105 105 00:03:31,772 --> 00:03:33,960 to fix vulnerabilities when they occur, 106 106 00:03:33,960 --> 00:03:36,330 but again, there's a very specific process 107 107 00:03:36,330 --> 00:03:38,910 and there's usually limited support from the manufacturer. 108 108 00:03:38,910 --> 00:03:40,530 It's not like Microsoft where they're going to give you 109 109 00:03:40,530 --> 00:03:42,060 a patch every Tuesday. 110 110 00:03:42,060 --> 00:03:44,820 With these PLCs, you might get a patch every six months 111 111 00:03:44,820 --> 00:03:46,230 or a year or two years. 112 112 00:03:46,230 --> 00:03:49,200 There's usually a very long time in between patches. 113 113 00:03:49,200 --> 00:03:50,340 Now, another way we can do this 114 114 00:03:50,340 --> 00:03:52,380 is using what's called a system on a chip. 115 115 00:03:52,380 --> 00:03:54,480 This is another form of embedded systems. 116 116 00:03:54,480 --> 00:03:56,550 This is where a processor integrates 117 117 00:03:56,550 --> 00:03:59,490 the platform functionality of multiple logical controllers 118 118 00:03:59,490 --> 00:04:01,110 onto a single chip. 119 119 00:04:01,110 --> 00:04:03,750 So instead of having all these big PLCs all over the place, 120 120 00:04:03,750 --> 00:04:06,870 we can get all that down to one single chip. 121 121 00:04:06,870 --> 00:04:10,290 Now, this system on a chip can be very power efficient 122 122 00:04:10,290 --> 00:04:12,720 and therefore they're often used with smaller devices 123 123 00:04:12,720 --> 00:04:14,220 that need to have an embedded system. 124 124 00:04:14,220 --> 00:04:15,240 So if I need to create something 125 125 00:04:15,240 --> 00:04:17,100 that's going to have an embedded system and be very small 126 126 00:04:17,100 --> 00:04:18,540 that can fit in my pocket, 127 127 00:04:18,540 --> 00:04:21,090 that'll usually use something like a system on a chip. 128 128 00:04:21,090 --> 00:04:22,350 If you're using something like a Roomba 129 129 00:04:22,350 --> 00:04:23,700 or robot vacuum cleaner, 130 130 00:04:23,700 --> 00:04:26,520 those use a system on a chip type of mentality, 131 131 00:04:26,520 --> 00:04:28,380 because they try to get all that information 132 132 00:04:28,380 --> 00:04:29,940 put onto a single chip, 133 133 00:04:29,940 --> 00:04:31,530 'cause again, it takes up less space 134 134 00:04:31,530 --> 00:04:32,970 and therefore you can leave more room 135 135 00:04:32,970 --> 00:04:36,240 for the functioning parts you need, such as the vacuum. 136 136 00:04:36,240 --> 00:04:37,650 Now the other thing we want to talk about 137 137 00:04:37,650 --> 00:04:39,240 is some of these operating systems they use. 138 138 00:04:39,240 --> 00:04:41,460 So there's this thing known as an RTOS, 139 139 00:04:41,460 --> 00:04:43,740 which is a real-time operating system. 140 140 00:04:43,740 --> 00:04:45,505 Now, this is a type of operating system 141 141 00:04:45,505 --> 00:04:49,470 that prioritizes deterministic execution of operations 142 142 00:04:49,470 --> 00:04:51,630 and this will help us to ensure consistent response 143 143 00:04:51,630 --> 00:04:53,490 for time critical tasks. 144 144 00:04:53,490 --> 00:04:54,600 Now think about this. 145 145 00:04:54,600 --> 00:04:56,820 If you're running something that has to open 146 146 00:04:56,820 --> 00:04:59,550 or shut a valve inside of a nuclear plant, 147 147 00:04:59,550 --> 00:05:02,760 can you have the ability for that to be offline at any time? 148 148 00:05:02,760 --> 00:05:03,960 Probably not, right? 149 149 00:05:03,960 --> 00:05:06,390 Well, that's the idea of where we would use an RTOS, 150 150 00:05:06,390 --> 00:05:08,220 a realtime operating system. 151 151 00:05:08,220 --> 00:05:10,110 This is because a lot of our embedded systems 152 152 00:05:10,110 --> 00:05:12,720 typically can't tolerate reboots or crashes, 153 153 00:05:12,720 --> 00:05:14,430 and they have to have these response times 154 154 00:05:14,430 --> 00:05:17,160 that are predictable within milliseconds. 155 155 00:05:17,160 --> 00:05:19,680 So if I'm building something that's going to run parts 156 156 00:05:19,680 --> 00:05:22,800 of an airplane that's going to help my autopilot fly 157 157 00:05:22,800 --> 00:05:24,630 and with the autopilot needs to make adjustments 158 158 00:05:24,630 --> 00:05:27,150 on the wings every couple of milliseconds, 159 159 00:05:27,150 --> 00:05:28,950 well that is something that we would want to use 160 160 00:05:28,950 --> 00:05:30,570 a real-time operating system for. 161 161 00:05:30,570 --> 00:05:32,880 We can't use a standard Windows system for that. 162 162 00:05:32,880 --> 00:05:34,710 It's just not fast enough or powerful enough 163 163 00:05:34,710 --> 00:05:36,416 and it's subject to rebooting or crashing 164 164 00:05:36,416 --> 00:05:39,000 and security patches and all that other stuff. 165 165 00:05:39,000 --> 00:05:41,310 So RTOS, when you hear that term, 166 166 00:05:41,310 --> 00:05:43,410 think about this as a type of operating system 167 167 00:05:43,410 --> 00:05:45,270 that's often used with embedded systems, 168 168 00:05:45,270 --> 00:05:47,550 especially in critical applications. 169 169 00:05:47,550 --> 00:05:50,220 Now, the last thing I want to talk about is an FPGA, 170 170 00:05:50,220 --> 00:05:52,470 which is a field programmable gate array. 171 171 00:05:52,470 --> 00:05:54,540 This is a type of processor that can be programmed 172 172 00:05:54,540 --> 00:05:57,390 to perform a specific function by a customer 173 173 00:05:57,390 --> 00:05:59,580 rather than at the time of manufacture. 174 174 00:05:59,580 --> 00:06:02,460 So if I'm going to use something like a system on a chip, 175 175 00:06:02,460 --> 00:06:04,890 that is going to be programmed by the manufacturer 176 176 00:06:04,890 --> 00:06:06,210 and whatever it's programmed to do, 177 177 00:06:06,210 --> 00:06:07,500 that's what it's going to do. 178 178 00:06:07,500 --> 00:06:09,990 But with a field programmable gate array, 179 179 00:06:09,990 --> 00:06:13,320 I as the customer can actually program what I want it to do. 180 180 00:06:13,320 --> 00:06:15,870 This is really useful if I have a more generic function, 181 181 00:06:15,870 --> 00:06:17,130 like open and shut a valve, 182 182 00:06:17,130 --> 00:06:19,380 but I need to tell it what time I want it to do it, 183 183 00:06:19,380 --> 00:06:21,810 or if I want to tell it how many seconds it should be open for 184 184 00:06:21,810 --> 00:06:23,730 and how many seconds it should be closed for. 185 185 00:06:23,730 --> 00:06:25,260 Those are things I can program in 186 186 00:06:25,260 --> 00:06:27,240 using a field programmable gate array. 187 187 00:06:27,240 --> 00:06:29,550 Now, the end customer here has the ability 188 188 00:06:29,550 --> 00:06:32,760 to program these things by configuring the programming logic 189 189 00:06:32,760 --> 00:06:35,280 and we can do this to run a specific application 190 190 00:06:35,280 --> 00:06:38,640 instead of using an application specific integrated circuit, 191 191 00:06:38,640 --> 00:06:41,520 like I was talking about a system on a chip design would. 192 192 00:06:41,520 --> 00:06:42,900 When you burn a system on a chip, 193 193 00:06:42,900 --> 00:06:44,850 that is the program you're going to have. 194 194 00:06:44,850 --> 00:06:47,130 When you're dealing with a field programmable gate array, 195 195 00:06:47,130 --> 00:06:48,930 you have the ability to change that.