Wind River Blog Network

Detecting security problems – using static analysis to catch them early and less expensively

By Bill Graham

In my previous post I discussed the potential benefits in quality and costs that static analysis brings to software development. In addition to common coding errors, many of the bugs found by static analysis are potential security defects as well.  Buffer overflow, OS command injection, unrestricted string format and integer overflows are among the top 25 most dangerous security coding defects (according to the Common Weakness Enumeration (CWS) from the MITRE organization). These types of defects are common in C and C++ and are dangerous to correct operation in general but also pose significant security threats – often because the right exploit can lead to arbitrary code execution on the target. Once an attacker can execute code on your device, they can gain complete control, which might include reflashing the firmware, installing malware or rewriting the command and control software.

Continue reading >>

Using Static Analysis to Improve Product Quality, Earlier and Cheaper

By Bill Graham

Fixing bugs is expensive. Fixing bugs is more expensive the later you leave them, in fact, its been shown to cost a magnitude higher with each major phase of development. The famous defect cost chart from Capers Jones shows the cost of a bug going from $25 at the coding phase to $16,000 in development.  Not only that, but most of the bugs are introduced into the system at this stage yet very little of them are found. Logic says we should fix them earlier to save money.

Continue reading >>

Android Security – making sense of all the choices

By Chris Buerger

Last week’s public release of the Security Enhanced (SE) Android project and associated source code is hailed by many as an important foundational step to add a new set of options to create secure Android devices. While the recent release of the code base by the National Security Agency (NSA) is familiar territory for Android experts such as Wind River who have been designing and implementing comprehensive security layers to a wide spectrum of Android devices for a few years now, the portrayal of this development in the media as an all-encompassing security solution grossly oversimplifies the complex subject matter that Android security represents.

Simply speaking, compiling and flashing the SE Android code base on to your Nexus S will not make it completely 'secure.'

Wind River has been enabling Android devices for close to five years now. Based on that experience and over a decade of pioneering mobile Linux-based devices, four key security-related points stand out.

Continue reading >>

 

Wind River Discusses Security and Safety Offerings with ICC Media

By Amanda Lowe

At IPC/SPS/Drives in November, Alexander Damisch, Wind River's Director, Industrial Solutions, sat down for an interview with ICC Media to discuss our recent collaborations with Wurldtech and ISaGRAF. 

Click on the video link below to learn more about the latest offerings. 

 

Continue reading >>

Hacking Insulin Pumps for Fun and Profit

By Ido Sarig

Last month, I had the opportunity to take part in the Amphion Medical Forum in Minneapolis, where the theme was security challenges facing Medical devices. Amphion is a forum that brings together thought leaders from academia, business, government and technology, which was founded to provide a medium for these visionaries to define solutions to some of the issues, such as safety and security, which affect the new interconnected economy, the “internet of things”.

I participated in a panel that discussed the challenges and risks posted by the latest generation of wireless medical devices, and how proper Fuzz Testing, such as the capability offered by Wind River Test Management in conjunction with our partner Codenomicon, can help alleviate some of that risk.

Continue reading >>

Security Needed Everywhere!

By Alex Wilson

It's been a busy couple of months at Wind River with conferences and seminars as we lead up to year end.  One key theme at the various events I have been to is that of the increased need for cyber-security, a theme that is becoming important in all areas of embedded computing.

The subject first came up in Toulouse at the SAE Aerotech conference.  I was there co-hosting a session with Airbus on use of multicore technology in safety certified systems, with a great presentation by our own Joachim Hampp, and also to present a paper on our VxWorks 653 solution as a guest of BARCO.  Apart from some very interesting sessions on IMA, Unmanned Vehicles, and safety certification, the other critical area was an update on cyber-security with presentations from Airbus, Boeing and government.

Continue reading >>

SPS/IPC/Drives, Security and Safety

By Alexander Damisch

The annual SPS/IPC/Drives event was held in Nuremberg last week, this event brings together the global leaders in automation space, including Bachmann, KW Software, ABB, Siemens, Rockwell, Yaskawa and Schneider Electric to name a few! Some key themes emanating at the event included: innovation, energy efficiency, machine-to-machine, security and safety.

Wind River made several exciting announcements at this year’s faire.

Continue reading >>

Secure Mobility Message Resonates at MILCOM 2011

By Chip Downing

MILCOM 2011 last week in Baltimore, MD was not only educational, but it was a watershed event.   Last year, it was a “coming out” party for custom Android devices; this year however, was the year where many companies are now using COTS hardware and software to their fullest extent, along the entire supply chain, from core to edge and user devices.   I believe this COTS adoption is driven by two powerful forces – the exploding capabilities of commercial tablet devices, and global military budget pressures.

The vastly increasing power and capability of commercially available mobile communications devices is simply amazing. Just a few years ago, almost everything in this military communications space was purpose built, and most commercial products were simply inadequate to address the rugged and complex system demands of military communications systems.   As seen at MILCOM 2011, this has officially changed -- COTS end-to-end communications domains rule.

So if all of these MILCOM vendors are not making customized hardware and software, what are they doing?   Wind River had over 500 people visit its booth at MILCOM this year, and most of the discussions I had with both suppliers and end users at the show were about increasing device security and leveraging high volume COTS components in demanding deployment scenarios.

Continue reading >>

Improving Embedded Device Security: Adopt Comprehensive Lifecycle Support

By Bill Graham

Security is constantly evolving as threats change over time. As a device becomes popular (Stuxnet targeted the market-leading PLC) or exists in the market longer, it becomes more susceptible to attack. Many devices in the past were not designed to be field programmable or accept updates without significant modifications. Those days are gone. Devices today must be field upgradeable to not only change and improve functionality, but to deal with bugs and security issues. Including security planning in the life cycle management of your device is critical. Moreover, it’s important that your organization deal with security vulnerabilities as they arise with high priority and rapid response times. Equally important is that you can rely on your COTS vendors to do the same; these components are an integral part of the lifecycle support plan.

Continue reading >>

Improving Embedded Device Security: Securing the Applications

By Bill Graham

Modern embedded devices are much more than small-scale dedicated systems with a single mode of operation. In fact, embedded systems can host several different functions and typically are evolved and expanded over time. The rise of multi-application embedded devices, partitioned and multi-OS systems implies an increase in the number of applications and updates, changes and installation of new and improved ones over time. As with desktop and server applications it becomes critical that embedded software applications deal with security as well. In fact, applications are likely to be the target of malicious code or data breaches – the installation of malicious application code, modification of existing applications or exploitation of vulnerabilities within the application itself. It’s vital that embedded applications are locked down on the device to prevent unintended data access or loss of operation.

Continue reading >>

How Security and Safety Regulatory Concerns Impact Public Transportation Industry

By Alexander Damisch

In my last blog, I discussed the changing mass transit landscape and the shift to commercial-off-the-shelf (COTS) technologies to meet the industry’s changing demands. In addition to price sensitivities and system complexities facing manufacturers, changes in security regulations, unknown safety and security threats, and an increasing amount of electronic systems with the potential for exposure to safety and security breaches, are causing regulatory bodies and insurance companies to demand that operators have the latest safety systems installed to protect against large scale accidents -- and this significantly impacts development.

Safety is paramount in any mass transportation system, from local trams to high-speed cross country trains. The standards governing safety systems have been evolving over time, and we're starting to learn from markets, such as aerospace, about the appropriate architectural concepts and model-based designs required to achieve effective certification standards. 

Continue reading >>

Improving Embedded Security: Proper Runtime Selection

By Bill Graham

Selection of secure components for an embedded system is key to a secure system. Leveraging a secure RTOS, middleware, virtualization and tools significantly reduces the effort and development costs. Moreover, there are additional benefits from using commercial-off-the-shelf (COTS) software components over Roll Your Own (RYO) code or self-ported and maintained open source code. Some of the COTS components worth considering include:

Continue reading >>

Improving Embedded Security: Leverage Advanced Security Design

By Bill Graham

Trying to address a long list of security requirements for a device on a case-by-case basis is time consuming, costly and frankly not the best way to approach the problem. Two important architectural approaches to consider are separation of concerns and component reuse. Separation of concerns means separating out significant portions of a system into separate subsystems so they can be dealt with on their own (with well defined boundaries and interfaces). The reasons for this are many but for security design, it might be better to separate out the portion of the system that requires higher security from the rest of the system. This provides many benefits in terms of simplifying the system design, the security assessment and most importantly testing and validation (see a technical paper on this here).

Continue reading >>

Unmanned Systems: More Reports of Security Vulnerabilities

By Joe Wlad

By now, you’ve likely heard the latest report of security holes in unmanned ground control systems. This time, a key-logging virus has been found on one or more hard drives at the Nevada operations center for the Predator and Reaper unmanned vehicles. While the investigation is ongoing and impact of the virus is determined, the real concern is just how vulnerable are these systems and what might happen next? This is not the first time security gaps have been uncovered in unmanned vehicles. In 2009, Iraqi insurgents were able to intercept unencrypted video feeds from operational Predator UAVs using inexpensive software downloaded from the Internet.

People in the public and private sector are expressing deep concern over how things like this can happen and to how address these problems. As for the “how we got here” question, it’s relatively simple to answer. Essentially, the unmanned air vehicle has been a victim of its own success. Many of these programs, Global Hawk, Predator and others were never designed to be deployed in operational environments. In fact, the DoD in many cases, sought to build these vehicles as prototypes or proof-of-concepts. When the programs were awarded, the diligent contractors for these vehicles used the best of commercial technology to demonstrate the capabilities. The hope was that successful demonstrations would lead to production contracts where the systems could be designed to meet specific security and safety requirements.

Continue reading >>

Five Steps to Improving Embedded System Security

By Bill Graham

Embedded device security needs to be integrated into the development lifecycle of the product rather than being an afterthought. The following are high level guidelines that embedded systems designers should consider when addressing security. This is not a prescriptive methodology, but intended to highlight an approach that looks at embedded security as a development lifecycle issue from requirements management, architecture and design and maintenance. 

Continue reading >>

Medical Devices, Life Savers

By Nikhil Chauhan

There's no doubt, medical devices are saving the most precious elements of nature - people's lives. The World Health Organization's video below highlights the importance of medical devices to health care.  Medical devices need to be secure and safe. My colleague Santhosh elaborated in a recent blog post on how FDA's 510(k) process is under scrutiny amidst the growing medical device recalls. 

Continue reading >>

Linux, Common Criteria and OS Protection Profiles

By Paul Parkinson

In 2011, computer and network security news stories, which were previously the preserve of specialist journals and blogs, have become commonplace in the mainstream media. There are now many different types of threat, which are sometimes categorised into hacktivist, e-crime and most recently, advanced persistent threats (APT). Whilst some of these attacks have exploited zero day vulnerabilities, many of these attacks have simply taken advantage of the fact that systems have not been configured securely for their deployment environment.

To use an easy–to-understand analogy, consider a wireless router. This device will generally be shipped from the factory in the most flexible, open communication configuration, which will have many or all of the security options disabled. This will be fine if the wireless router is intended to be used as a free public Wi-Fi access point (e.g., cyber cafe), but not for a private business or home office if you want to prevent drive-by wireless hacks).  In these cases, wireless encryption such as WPA2 will need to be enabled for the router and clients, and access may even need to be restricted to specific clients via MAC addresses, etc.

Continue reading >>

Embedded Virtualization to Underpin Next Generation Network-Centric Operations

By Chip Downing

“Embedded virtualization” is a technology that is rapidly proliferating in global defense systems that deliver critical data to warfighters.  Embedded virtualization is typically instantiated in small layer of software called a hypervisor that controls all activities and functions on a microprocessor deployed in a military control and communications equipment.

These hypervisors can be foundations for hosting a wide range of complex, dynamic applications for network-centric operations (NCO), electronic warfare (EW) and spectrum planning/electronic warfare battle management (EWBM) systems. Hypervisors enable the migration of existing capabilities from legacy NCO programs onto next generation platforms, enabling wider integration and preserving program investment.  

Continue reading >>

The Embedded Security Paradox

By Bill Graham

For embedded systems developers, there exists a paradox in that security for the device is a high priority or "must-have" capability but it’s at odds with market and business requirements for their device as this often lengthens development time. Not only that, the nature of embedded systems is changing to a highly networked interconnected environment that increases the demand for security while further complicating it. Let's look at this in a bit more depth:

Delicate Balance

Embedded developers are more aware of security requirements for their devices. However, they need to balance the design and implementation of security in the device with its functionality, performance, and intended market. Furthermore, securing a device must not cause its delivery to be well beyond the forecast schedule or cost. Although security is an important feature for a device, it is not necessarily a differentiating feature, yet expected capability. Customers expect security but won't pay more for it nor choose your product over another because of it (in the long term). A delicate balance is required to make sure a device is as secure as it can be given these competing factors.

Continue reading >>

Unmanned Systems No Longer Require Human, or Canine, Participation

By Joe Wlad

Forty-plus years ago, when automatic pilots were first used to perform automatic landings of large aircraft, there was a joke that was circulated among pilots everywhere. Future aircraft would be manned only by a single pilot and a dog. The pilot’s job would be to feed the dog. The dog’s job would be to bite the pilot if she or he touched anything. Today, we’ve advanced well beyond that presageful joke, and airborne systems can now operate autonomously without human, or canine, participation.

One key event taking place this week, that Wind River is exhibiting at, is the Association for Unmanned Vehicle Systems International (AUVSI) North America, which showcases the latest trends and technologies in unmanned systems. This event consistently attracts a lot of attention and participation. In fact, this year’s show in Washington, DC is likely to have record participation, which is indicative of the trends we’re seeing in automated and unmanned systems designs.

Ever since hobbyists have demonstrated the ability to control model-sized aircraft using radio signals, engineers conceived of controlling larger-scale unmanned aircraft for both military and civilian purposes. A number of the research efforts for unmanned aircraft over the past two decades have now evolved into larger rate production, and in some cases, deployment in the Iraq and Afghanistan war zones. While this is a tribute to the engineers and architects of these designs, one negative consequence of this success is that we now have many unmanned systems that cannot easily coexist with manned aircraft because lack of standards and regulatory requirements for unmanned vehicles. Moreover, the systems in use today are not interoperable. In other words, each unmanned air vehicle is tied to a unique ground station which increases the cost of design and certification.

Continue reading >>

Embedded Device Security: Information Assurance and Cyber Security

By Marc Brown

Security is a heavily overloaded term, meaning different things to different people. In the embedded systems world, news on security is often about Stuxnet or similar attacks where an enemy can control devices remotely and shut them down, make them behave abnormally, or worse, cause equipment failure and destruction.  In the enterprise world there is news of information breaches and sensitive data exposure which often seems to be unrelated to embedded systems. However, for embedded security it’s important to consider both the safe and correct behavior of the system and the data it may store or transmit. These two key areas of security concerns and priorities are as follows.  

Continue reading >>

Testing for Security

By Ido Sarig

Last summer was a watershed event for security-consciousness in the embedded systems world: Stuxnet, a highly sophisticated worm exploited no fewer than 4 zero day vulnerabilities in Windows in order to attack a specific Siemens PLC and its associated SCADA system. The target was reportedly the Iranian nuclear facilities at Natanz, where uranium-enrichment centrifuges were taken out of commission by the worm’s malicious payload. It was perhaps not the first, but certainly the most well-publicized successful attack on critical infrastructure systems.

The software security industry has been discussing such an attack for years, mostly as a theoretical possibility – but now it appears this is no longer the stuff that Hollywood scripts are made of - it is all too real.

Continue reading >>

Strengthening Security for Connected Medical Devices

By Santhosh Nair

Three years ago an article in the New England Journal of Medicine reported that computer hackers could gain wireless access to implanted pacemakers and shut them off, or reprogram defibrillators to deliver fatal jolts of electricity. This generated an avalanche of press worldwide about the hidden risks of medical devices, followed by requisite hand-wringing from politicians and promises of stiffer regulations. For this and other reasons, makers of medical devices have been steadily increasing their focus on security. They realize that the threat is far broader than a hacked ICD. Embedded software is part of everything from CT scanners to imaging systems to intensive-care ventilators. And the fact is, the rapid growth in the number, the intelligence, and the interconnectedness of medical devices has created an upward spiral in security threats. 

Continue reading >>

 

The new front in cyber warfare: embedded systems

At the recent Take Down Conference, a scheduled talk on security vulnerabilities in SCADA (Supervisory Control And Data Acquisition) systems was cancelled due to direct requests from the Department of Homeland Security and Siemens (CNET - "SCADA hack talk canceled after U.S., Siemens request" . The request was made because the details of the vulnerabilities and the exploits associated with these vulnerabilities were too sensitive at this point in time.  (The researchers have announced that these will be revealed at the upcoming Black Hat conference in August 2011).

This type of request is unusual since the common approach of researchers in the security field is full disclosure so that vulnerabilities are well understood and hopefully, quickly fixed. What this does indicate is the emerging importance of embedded system security in the eyes of the government, the security research community and the technology media in general. The Stuxnet malware initiated this new awareness since its public revelation in 2010.

Embedded systems are the key control and data acquisition point for much our infrastructure - power grid, nuclear power plants, dam control, factory control, robotics, etc. 

Continue Reading >>

 

IDEF 2011

By Paul Parkinson

Recently, I attended the IDEF 2011 defence trade show in Instanbul as part of the Wind River team exhibiting on the Tektronik (Turkish distributor) stand.

Our partner, Curtiss-Wright, who were also exhibiting at the event, had kindly lent me a VPX chassis and VPX6-185 board, which I used to demonstrate a Cross-Domain Solution (CDS) demo running on VxWorks MILS. The demo filters packets of data between black and red networks based on the security classification of the data, and uses multiple partitions to implement sender and receiver on different interfaces.

The demo currently uses a simple encryption algorithm for data passed over the black network (which wouldn't present much of a challenge to GCHQ/CESG or NSA),  so I decided to replace it with a stronger encryption algorithm which is more appropriate for real world systems. I initially considered using an open source implementation of AES-256, but then I remembered the export controls on 256-bit AES, so I decided to use a public domain implementation of the Russian GOST 28147-89 (which also uses a 256-bit keys).

Continue Reading >>

Is Linux Secure?

By Paul Anderson

It’s the wrong question, really. Are my financial and medical records secure? What about all that information stored in the cloud? What about my desktop computer or cell phone? What about the power grid and other infrastructure? Should I be worried?

The answer to all those questions is “It depends on what you mean by ‘secure.’” One may need to consider: What is the definition security? Or what is an acceptable level of risk at that level of security?

Continue Reading>>

 

Wind River Turns 30: Looking Back and Moving Forward

By Tomas Evensen 

2011 marks Wind River’s 30th anniversary. The big 3-0…it’s a major landmark moment in anyone’s book. This year, we’ll be taking time to honor this milestone with a retrospective of Wind River’s history and also a series of employee stories.  In my many years with the company, Wind River always impressed on me the concept of  being bigger than just a single product or technology. There is an underlying spirit within our teams that constantly reaches for more, for some greater innovation. While many customers know Wind River for the VxWorks real-time operating system, it was always part of the vision to provide more value. In the early days, this entailed providing a TCP/IP stack and GDB for debugging. Later, additional value came from strong IDE support through Tornado and Workbench. Lately, it has been by providing a choice of operating systems, real-time or open source/Linux. 

A standout example that exemplified the vision of providing a more complete solution was when we embarked on creating a truly embedded hypervisor. In 2004, it had already become clear to us that virtualization would play an important role in embedded designs at some point in the future. In early 2005, Paul Borman who worked for me in the CTO Office created a very impressive prototype, called eCPU, that ran VxWorks and Linux on a single CPU and we learned a lot from that effort. When Johan Fornaeus came on board in 2006 through an acquisition (he was co-founder of Interpeak and before that, one of the co-designers of the Enea/OSE operating system), I had him leading a small nimble task force team to develop a hypervisor really suited for the embedded space. I felt we made a real breakthrough. This was not a repackaged operating system pretending to be something it was not designed for, but instead a truly unique approach to virtualization and separation. Over the next couple years, this small team created a scalable product with an extremely tight footprint, incredible performance, while at the same time being full featured for the common architectures such as Intel, Power, ARM and MIPS.

Back in those days, it was not clear to us when and how important multi-OS systems would be in the future, but today it is hard to imagine how to deal with these new complex systems without a hypervisor for embedded virtualization. Looking at my team’s achievement now, I still marvel at how the Wind River Hypervisor brings together multi-core and our various operating systems. Why choose between operating systems with different characteristics when you can mix them in one system? Throw in a networking stack optimized for multi-core and tools that can debug and find performance bottlenecks and you get a very capable foundation on which our customers can innovate.

By constantly looking to the future, Wind River continues to evolve and further build on its expertise. The ongoing push to innovate may have created interesting and complex challenges along the way. However, it has also resulted in celebrations and breakthroughs, and it’s undoubtedly a big reason why so many of us continue to stay on the ride. 

 

Fun with VxWorks MILS 2.1

By Paul Parkinson

It's been awhile since my previous blog, as I have been rather preoccupied with responding to a number of RFPs. However, I’ve managed to find some time to work on some demos for VxWorks MILS 2.1, which has been fun.

VxWorks MILS 2.1 introduced support for Wind River Linux as a Guest OS (VxWorks Guest OS and High Assurance Environment (HAE) having been supported in the earlier VxWorks MILS 2.0 release). I wanted to get some more hands-on experience of using Wind River Linux as a Guest OS (GOS) running on the VxWorks MILS 2.1 Separation Kernel (SK). So, I started with a version of theBlaster Blastee demo which had been modified by one of my colleagues in Engineering to use a Linux GOS partition for the Blaster. (Blaster Blastee is a well-known Wind River demo which provides a nice flexible framework for blasting TCP or UDP packets between nodes, testing network connectivity and performance).

 I thought it would be an interesting exercise to extend the demo to also use Linux in a second partition as the Blastee (receiver), to demonstrate the scalability and determinism of the MILS SK with multiple Linux virtual boards (VB).

Continue Reading>>

 

The Dawn of a Paradigm Shift in Embedded Device Software Security

By Marc Brown

The number of connected embedded and mobile devices is increasing exponentially, predicted to be in excess of 50 billion by 2020.  The lion’s share of this growth is expected to come from traditional market segments where there is an increasing push to transform sensing equipment to more autonomous embedded control, real-time telemetry, and proactive diagnostics. We all know website hacking is nothing new, but just imagine having your public water utility meter, your automobile safety functions, our public transportation traffic sensors, or even the national power grid being hacked by organized criminals or nation states.  This tsunami of connectivity and more intelligent control is creating a huge increase in security vulnerabilities that can impact financial profitability, public services and safety, and national defense. 

Many of today’s most advanced embedded control systems are based on a collection of standalone components – embedded operating systems, virtualization technologies, communication stacks, middleware, and application code.  These standalone products, and the companies that create them, lack the integrated security support required in today’s highly connected world, offering overall solutions that are only as safe as the weakest link. 

McAfee and Wind River have formed a strategic partnership to develop and support comprehensive, purpose-built security solutions specifically designed for these next-gen embedded devices.  

Continue Reading >>

Being Helpful or Simply Correct?

By Jakob Engblom

The other day, I spent some time getting a new operating system up on one of our Simics virtual platforms. The platform is stable, the hardware is shipping and it is being used with the very software I was setting up. However, as the operating system was booting, I got quite a lot of warnings from Simics about incorrect hardware settings. The operating system still worked, however, so why did we see all these warnings? Actually, when is it prudent to issue warnings to a user about suspicious uses of hardware? When building Simics models, we want them to be helpful and offer warnings as much as possible - especially for cases where some uses might be considered technically "correct" but are actually somewhat suspicious.

A virtual platform like Simics can print warnings to the simulation console when software performs operations that are not legal according to the hardware specification. Typical examples are writing to offsets in device register banks where there are no registers, changing the value of bits which are marked as "reserved", or writing illegal values to configuration registers.

Continue Reading >>