Instructor: Embedded system vulnerabilities. 2 2
In this lesson, we're going to start talking 3 3
about some embedded system vulnerabilities, 4 4
because we talked about the fact 5 5
that a lot of these devices that we connect to the internet 6 6
as part of the internet of things at large, 7 7
do have embedded operating systems, 8 8
like Linux or Android or other things like that. 9 9
Now, when we talk about an embedded system, 10 10
this is a computer system that is designed 11 11
to perform a specific and dedicated function. 12 12
Now, oftentimes when we talk about an embedded system, 13 13
we're talking about things more in the manufacturing space 14 14
or automation space. 15 15
So we might have a microcontroller in a medical drip system, 16 16
that it has one job, it's to measure the amount of volume 17 17
of fluid that goes through that machine and into your IV 18 18
so you can give the patient what they need. 19 19
You might have another one for a control system 20 20
at a water treatment plant 21 21
and its responsibility is to make sure 22 22
that water is flowing through at a certain rate 23 23
and they're going to open or close valves 24 24
to make sure we maintain that amount of flow 25 25
through the system. 26 26
This is the idea of an embedded system 27 27
and it can be a very, very simple device 28 28
or it can be fully complex 29 29
and have a full operating system, 30 30
like Linux or Android being used 31 31
to run these type of systems. 32 32
It just depends. 33 33
Now, in this particular lesson, 34 34
I'm going to focus more on the specific embedded systems 35 35
that have a single function 36 36
and they have their own dedicated operating system 37 37
or microprocessors to do that function. 38 38
For instance, at my house, I have a smart meter. 39 39
So if I go out to my side of my house, 40 40
I can look at the electric meter on my house 41 41
and it'll tell me how many kilowatts per hour I am using 42 42
and how much I've used over time. 43 43
Now, this information is connected to the internet 44 44
so that the power company doesn't have to send somebody 45 45
to my house to read this meter once a month. 46 46
Instead, it's all done electronically now. 47 47
They do this by using cellular modems 48 48
and it connects through the cellular network, 49 49
back over the internet, 50 50
to their headquarters and to their servers 51 51
to feed in the data of what we've used 52 52
for power consumption. 53 53
If you look at your meter at your house, 54 54
you probably have something that looks pretty similar. 55 55
Now, these types of embedded systems 56 56
are considered static environments 57 57
where frequent changes are not made or allowed. 58 58
So when's the last time you upgraded the software 59 59
on your electric meter, for instance? 60 60
You probably never have, 61 61
and the power company probably doesn't do it 62 62
very frequently either. 63 63
That's the idea of these embedded systems. 64 64
They are a very stripped down system 65 65
that is made to do one purpose and one purpose only. 66 66
And by doing that, that helps them become more secure 67 67
because they don't have a lot of extra code. 68 68
But if that original code wasn't made in place 69 69
in a good state, it makes it hard to do updates, 70 70
because these things aren't built 71 71
to be able to get frequent software updates. 72 72
Because of this, embedded systems often have 73 73
very little support for identifying 74 74
and correcting security issues. 75 75
You can't call up the power company 76 76
and tell them to come secure your meter. 77 77
That's just not part of what they're going to do for you. 78 78
They're going to do it the way they want to do it 79 79
because it's their device. 80 80
And often, if you have an embedded system 81 81
inside your factory or inside your plant, 82 82
if you are in a manufacturing area, 83 83
you're going to have limited support from that manufacturer 84 84
and so this is an area 85 85
where you really want to get all these devices 86 86
onto a separate network 87 87
and not have them connected back to the internet at large 88 88
or this could be a big area of vulnerability for you. 89 89
Now, when we talk about embedded systems, 90 90
there's a term called PLC, 91 91
which is a programmable logic controller. 92 92
This is a type of computer that's designed for deployment 93 93
in industrial or outdoor setting 94 94
and it can automate and monitor mechanical systems. 95 95
Now, when you think about a PLC, 96 96
I want you to think of something like manufacturing 97 97
that's going to open or shut a valve 98 98
to let more or less water come in. 99 99
That's the idea of a PLC. 100 100
It is a programmable logic controller. 101 101
Now, these PLCs run on firmware, 102 102
because again, these are embedded systems. 103 103
So the firmware, which is software on a chip 104 104
can be patched and reprogrammed 105 105
to fix vulnerabilities when they occur, 106 106
but again, there's a very specific process 107 107
and there's usually limited support from the manufacturer. 108 108
It's not like Microsoft where they're going to give you 109 109
a patch every Tuesday. 110 110
With these PLCs, you might get a patch every six months 111 111
or a year or two years. 112 112
There's usually a very long time in between patches. 113 113
Now, another way we can do this 114 114
is using what's called a system on a chip. 115 115
This is another form of embedded systems. 116 116
This is where a processor integrates 117 117
the platform functionality of multiple logical controllers 118 118
onto a single chip. 119 119
So instead of having all these big PLCs all over the place, 120 120
we can get all that down to one single chip. 121 121
Now, this system on a chip can be very power efficient 122 122
and therefore they're often used with smaller devices 123 123
that need to have an embedded system. 124 124
So if I need to create something 125 125
that's going to have an embedded system and be very small 126 126
that can fit in my pocket, 127 127
that'll usually use something like a system on a chip. 128 128
If you're using something like a Roomba 129 129
or robot vacuum cleaner, 130 130
those use a system on a chip type of mentality, 131 131
because they try to get all that information 132 132
put onto a single chip, 133 133
'cause again, it takes up less space 134 134
and therefore you can leave more room 135 135
for the functioning parts you need, such as the vacuum. 136 136
Now the other thing we want to talk about 137 137
is some of these operating systems they use. 138 138
So there's this thing known as an RTOS, 139 139
which is a real-time operating system. 140 140
Now, this is a type of operating system 141 141
that prioritizes deterministic execution of operations 142 142
and this will help us to ensure consistent response 143 143
for time critical tasks. 144 144
Now think about this. 145 145
If you're running something that has to open 146 146
or shut a valve inside of a nuclear plant, 147 147
can you have the ability for that to be offline at any time? 148 148
Probably not, right? 149 149
Well, that's the idea of where we would use an RTOS, 150 150
a realtime operating system. 151 151
This is because a lot of our embedded systems 152 152
typically can't tolerate reboots or crashes, 153 153
and they have to have these response times 154 154
that are predictable within milliseconds. 155 155
So if I'm building something that's going to run parts 156 156
of an airplane that's going to help my autopilot fly 157 157
and with the autopilot needs to make adjustments 158 158
on the wings every couple of milliseconds, 159 159
well that is something that we would want to use 160 160
a real-time operating system for. 161 161
We can't use a standard Windows system for that. 162 162
It's just not fast enough or powerful enough 163 163
and it's subject to rebooting or crashing 164 164
and security patches and all that other stuff. 165 165
So RTOS, when you hear that term, 166 166
think about this as a type of operating system 167 167
that's often used with embedded systems, 168 168
especially in critical applications. 169 169
Now, the last thing I want to talk about is an FPGA, 170 170
which is a field programmable gate array. 171 171
This is a type of processor that can be programmed 172 172
to perform a specific function by a customer 173 173
rather than at the time of manufacture. 174 174
So if I'm going to use something like a system on a chip, 175 175
that is going to be programmed by the manufacturer 176 176
and whatever it's programmed to do, 177 177
that's what it's going to do. 178 178
But with a field programmable gate array, 179 179
I as the customer can actually program what I want it to do. 180 180
This is really useful if I have a more generic function, 181 181
like open and shut a valve, 182 182
but I need to tell it what time I want it to do it, 183 183
or if I want to tell it how many seconds it should be open for 184 184
and how many seconds it should be closed for. 185 185
Those are things I can program in 186 186
using a field programmable gate array. 187 187
Now, the end customer here has the ability 188 188
to program these things by configuring the programming logic 189 189
and we can do this to run a specific application 190 190
instead of using an application specific integrated circuit, 191 191
like I was talking about a system on a chip design would. 192 192
When you burn a system on a chip, 193 193
that is the program you're going to have. 194 194
When you're dealing with a field programmable gate array, 195 195
you have the ability to change that.