Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #26949

Re: Is there a process for secure firmware install/upgrade for device made offshore?

Show all headers | View raw

On 6/25/2017 2:05 PM, Dave Nadler wrote:
> On Sunday, June 25, 2017 at 4:53:29 PM UTC-4, Don Y wrote:
>> ...A really huge number of words about a point already covered....
> 
> You are missing the point.
> We all know security of these things can be beaten at a cost.

And, that cost is LOW and headed LOWER!

20 years ago, the idea of deencapsulating or microprobing a die was
an esoteric attack.  Now, you can use a lab at your local university
to do so.

20 years ago, monitoring power supply currents or analyzing bus signals
and tracing tens/hundreds of thousands of bus cycles would require a
REALLy high end logic analyzer or DSO.  Today, you can buy them for
"lunch money" at surplus auctions.

Brute force attacks on 48 bit keys were unheard of.  Now, you
can get get your neighbor's WiFi password in 24-48 hours time
without him ever knowing you've been snooping on his transmissions.

Planning your development strategy around something that you *think*
is unaffordable/impractical -- especially in an era where folks will
make their tools/expertise available "for free" or "in kind" -- is
simply foolhardy.

Unless, of course, you design your product -- and the expectations
of the folks who BUY THEM -- around a very short product lifetime:
	"Please discard your baby monitor after your child's first
	birthday as there is a high probability that the SECURITY
	in its design will be compromised by that time... and we'll
	probably NOT be supporting it at that time -- so, any
	security flaws will be BAKED IN thereafter!"

WTF incentive did folks have to hack BABY MONITOR?  Yet, they *did*!
Do they like listening to babies crying?  Cooing?  Mothers talking
to their infant children?  etc.

I know a guy who *hand* disassembled 48K of ASM for a video game
"just because".  And, in doing so, identified all of the copy protection
mechanisms that had been added to the code to prevent its unintended
alteration.  Had he been *financially* motivated, what damage could
he have done by publishing that information?  (video games were $2K
devices and a few hundred kilobucks, per game, to design; imagine being
able to clone that game and save those hundreds of kilobucks of
development cost!)  Imagine how he'd do that, today, with the sorts
of tools that are CHEAPLY available.

The OP seems to think "reputation" and "product control" are important.
Is he only interested in the short term??

If you don't want folks reverse engineering/hacking/pwning your products,
then design a product that NO ONE WANTS!

> If I understood the OP correctly, he's looking for common methods
> of getting the cost high enough to make it hard to clone/reverse.
> Which is the question I answered...
> 
> Please, enough now...
> 

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-23 21:34 -0700
  Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 09:11 -0700
    Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 15:27 -0700
      Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 16:42 -0700
        Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 19:26 -0700
          Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 21:05 -0700
      Re: Is there a process for secure firmware install/upgrade for device made offshore? "Bill Davy" <Bill@XchelSys.co.uk> - 2017-06-25 10:37 +0100
        Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 02:47 -0700
      Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-06-25 13:05 +0200
  Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-24 21:59 -0700
    Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-24 23:14 -0700
  Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 07:59 -0700
    Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 10:43 -0700
      Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 12:43 -0700
        Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:13 -0700
          Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 13:18 -0700
            Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 13:53 -0700
              Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-25 14:05 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 14:24 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 16:46 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 18:19 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 18:57 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Don Y <blockedofcourse@foo.invalid> - 2017-06-25 19:14 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? David Brown <david.brown@hesbynett.no> - 2017-06-26 09:26 +0200
  Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-25 19:27 -0700
  Re: Is there a process for secure firmware install/upgrade for device made offshore? Stef <stef33d@yahooI-N-V-A-L-I-D.com.invalid> - 2017-06-26 08:56 +0200
  Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-26 12:35 -0700
  Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-29 16:09 +0200
    Re: Is there a process for secure firmware install/upgrade for device made offshore? Dave Nadler <drn@nadler.com> - 2017-06-29 10:44 -0700
      Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-29 20:22 -0700
        Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:44 +0200
      Re: Is there a process for secure firmware install/upgrade for device made offshore? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:35 -0400
      Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-06-30 13:33 +0200
        Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-06-30 17:11 -0700
          Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-03 12:05 +0200
            Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-03 10:16 -0700
              Re: Is there a process for secure firmware install/upgrade for device made offshore? "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-07-04 13:32 +0200
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-04 13:40 -0400
                Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-05 14:14 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-07-05 19:51 -0400
                Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-07-07 17:09 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Chris <xxx.syseng.yyy@gfsys.co.uk> - 2017-07-17 18:52 +0000
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Hans-Bernhard Bröker <HBBroeker@t-online.de> - 2017-07-17 21:38 +0200
                Re: Is there a process for secure firmware install/upgrade for device made offshore? jhnlmn@gmail.com - 2017-08-12 18:04 -0700
                Re: Is there a process for secure firmware install/upgrade for device made offshore? Paul Rubin <no.email@nospam.invalid> - 2017-08-14 09:53 -0700

csiph-web