Firmware
IoT Firmware Security Scan (FSS) provides security scanning services for the firmware of Internet of Things (IoT) devices. It detects security risks, such as known Common Vulnerabilities and Exposures (CVE) vulnerabilities and sensitive information, and provides recommendations for security fixes. FSS improves the security of IoT devices and raises the security baseline for these devices. This helps manufacturers reduce updates, product recalls, and over-the-air (OTA) upgrades caused by firmware vulnerabilities.
Preparations
Register an Alibaba Cloud account and complete identity verification. For more information, see Account Registration (PC) and Individual Identity Verification.
Use the AccessKey ID and AccessKey secret of your Alibaba Cloud account to access FSS open APIs.
Create an AccessKey ID and AccessKey secret for a Resource Access Management (RAM) user. Use the generated AccessKey ID and AccessKey secret to access FSS open APIs. For more information, see Alibaba Cloud RAM and RAM authentication.
Usage instructions
FSS supports Alibaba Cloud accounts and Resource Access Management (RAM) users and provides three methods for performing security checks on firmware:
Open APIs. You can call the relevant APIs to submit firmware for scanning and to retrieve scan reports. For more information, see API overview.
The firmware file size cannot exceed 1 GB.
Embedded Linux firmware (such as Yocto, OpenWrt, and uClinux) and Android firmware are supported.
The following firmware file formats are supported:
.zip,.rar,.img,.tar,.gz,.tar.gz, and.gzip.If a message indicates that no scan attempts are available, request more scan attempts.
Features
FSS supports two main types of firmware: Linux and Android. This includes embedded Linux firmware (such as Yocto, OpenWrt, and uClinux) and Android firmware.
FSS can detect five major categories of risks: CVE vulnerabilities, configuration risks, key security, sensitive information leakage, and code security. The following table describes these categories.
Category | Risk Name |
CVE vulnerabilities | Open source component CVE vulnerability scan |
Configuration risks | System weak password scan |
Unnecessary software scan | |
Remote management software risks | |
Alibaba Cloud IoT-LV_SDK encryption in transit configuration | |
Key security | Private key security scan |
Certificate security scan | |
Sensitive information leakage | SVN information leakage |
Git information leakage | |
vi/vim information leakage | |
Backup file leakage | |
Temporary file leakage | |
Source code leakage | |
Plaintext storage of sensitive data in configuration files | |
Code security | Cracked or risky encryption algorithms |
Scenarios
Secure Development Lifecycle (SDLC): IoT device manufacturers can embed FSS into their SDLC. Before a release, upload the device firmware and export the security scan report. Use the recommendations in the report to fix issues and update the device firmware.
Device firmware upgrade: IoT device manufacturers or OTA vendors can upload a device firmware upgrade package. The firmware scanning service then scans the package and exports a security scan report. You can use the recommendations in the report to fix issues and update the device upgrade package.
Firmware security assessment: Security assessment agencies or IT supply chain managers can submit firmware to FSS to obtain a security scan report. They can then use the scan results to assess the security risk level of the firmware.
Start a scan from the FSS console
Log on to the product console.
In the navigation pane on the left, choose Assets > Firmware.
Click the Create Scan Task button, configure the parameters, and choose a method to obtain the device firmware.
Upload Firmware: Upload a firmware file to scan.
Firmware Address: Enter the Alibaba Cloud OSS URL of the firmware. After the task starts, the service automatically downloads the firmware and runs the scan.
After you complete the configuration, click Start Scan. Then, confirm the firmware information, select the I have read and agree to the preceding statements checkbox, and click Start Scan again.
View the scan report
When the scan task status is Completed, go to the Assets > Firmware page and click Scan Report to view the results.