186
A. Francillon et al.
building block for additional and more complex security mechanisms. We therefore
classify embedded devices using the following taxonomy:
Type-0:
Multipurpose / non-embedded systems.
We use Type-0 in order to reference traditional general-purpose systems.
Type-I:
General purpose OS-based devices (e.g., Linux-based).
The Linux OS kernel is widely used in the embedded world. However, in comparison to the traditional GNU/Linux found on desktops
and servers, embedded systems typically follow more minimalist
approaches. For example, a very common configuration that can be
found in consumer-oriented products as well as in Industrial Control
Systems (ICS) is based on the Linux kernel coupled with BusyBox
and uClibc.
Type-II:
Embedded OS-based devices.
These dedicated operating systems targeted at embedded devices systems are particularly suitable for devices with low computation power,
which is typically enforced on embedded systems for cost reasons.
Operating systems such as uClinux or FreeRTOS are suitable for
systems without a Memory Management Unit (MMU) and are usually
adopted on single-purpose user electronics, such as IP cameras, DVD
players and Set-Top Boxes (STB).
Type-III: Devices without OS-Abstraction.
These devices adopt a so called “monolithic firmware”, whose operation is typically based on a single control loop and interrupts triggered
by the peripherals in order to handle external events. Monolithic
firmware can be found in a large variety of controllers of hardware
components, such as CD-readers, WiFi-cards or GPS-dongles.
11.2 Obtaining Firmware and Its Components
Even though complete black box analysis of embedded devices is possible to some
degree and in certain situations, obtaining the firmware significantly helps and
makes more advanced analyses possible. There are two main ways to obtain the
firmware for a given device—as a firmware package (e.g., online, support media)
and through extraction from the device itself.
11.2.1 Collecting Firmware Packages
The environments in which embedded systems are deployed are heterogeneous,
spanning a variety of devices, vendors, CPU/hardware architectures, instruction
A. Francillon et al.
building block for additional and more complex security mechanisms. We therefore
classify embedded devices using the following taxonomy:
Type-0:
Multipurpose / non-embedded systems.
We use Type-0 in order to reference traditional general-purpose systems.
Type-I:
General purpose OS-based devices (e.g., Linux-based).
The Linux OS kernel is widely used in the embedded world. However, in comparison to the traditional GNU/Linux found on desktops
and servers, embedded systems typically follow more minimalist
approaches. For example, a very common configuration that can be
found in consumer-oriented products as well as in Industrial Control
Systems (ICS) is based on the Linux kernel coupled with BusyBox
and uClibc.
Type-II:
Embedded OS-based devices.
These dedicated operating systems targeted at embedded devices systems are particularly suitable for devices with low computation power,
which is typically enforced on embedded systems for cost reasons.
Operating systems such as uClinux or FreeRTOS are suitable for
systems without a Memory Management Unit (MMU) and are usually
adopted on single-purpose user electronics, such as IP cameras, DVD
players and Set-Top Boxes (STB).
Type-III: Devices without OS-Abstraction.
These devices adopt a so called “monolithic firmware”, whose operation is typically based on a single control loop and interrupts triggered
by the peripherals in order to handle external events. Monolithic
firmware can be found in a large variety of controllers of hardware
components, such as CD-readers, WiFi-cards or GPS-dongles.
11.2 Obtaining Firmware and Its Components
Even though complete black box analysis of embedded devices is possible to some
degree and in certain situations, obtaining the firmware significantly helps and
makes more advanced analyses possible. There are two main ways to obtain the
firmware for a given device—as a firmware package (e.g., online, support media)
and through extraction from the device itself.
11.2.1 Collecting Firmware Packages
The environments in which embedded systems are deployed are heterogeneous,
spanning a variety of devices, vendors, CPU/hardware architectures, instruction