Firms Slow To Secure Flaws In Embedded Devices

At the Black Hat Security conference earlier this year, Jerome Radcliffe, a security researcher who has diabetes, showed off weaknesses in the security of a popular insulin pump. Last month, another researcher at security firm McAfee expanded on the attack, showing how the pumps could be easily attacked and that manufacturers were unprepared to fix the problem.

The hack of the insulin pump demonstrates a major problem with embedded devices: Most systems were never designed to be easily updated. With researchers increasingly looking at software systems embedded in automobiles, network routers, printers, and industrial control systems, a growing number of vulnerabilities will be found. Yet fixing those flaws in the field is not easy, says Stuart McClure, general manager of risk and compliance for McAfee.

"It takes a year to get any bit on the device changed," he says. "It is a big problem that has to be overcome in order to secure the systems."

Android phones are another example. While Google fixes the flaws on the devices quickly, many patches languish in manufacturers' development shops or in quality assurance testing at the carrier.

The problems will become only more common. Security researchers are increasingly targeting the embedded software in devices because general-purpose computer systems have become tougher to exploit, says Ron Gula, chief technology officer for Tenable Network Security.

"We got really, really good at securing Microsoft, so what are people doing? They are going after an easier target," Gula says.

For companies worried about vulnerable embedded devices in their networks, the first action should be to identify every network-connected device and look for vulnerable services. No company should be running a telnet service, even inside the corporate network, Gula says.

"There are devices that you might not know are in your network, so scanning is critical," he says.

Cordoning off the devices that are known to be vulnerable from general network access is a good next step. While business users might want remote administration capabilities, such convenience sacrifices security, says Eric Knapp, director of critical infrastructure markets for NitroSecurity.

"As soon as you give them remote access, you open up a potential security hole," Knapp says.

Finally, any company that makes an appliance or embedded device needs to solve the problem of patches that significantly lag vulnerabilities, Tenable's Gula says. Companies should push their vendors to find ways to securely speed up patch deployment, similar to the major software vendors in the personal computer market.

"We are familiar with Microsoft Tuesday; there is nothing like a Cisco Wednesday," Gula says. "You really need transparency with embedded devices to figure out what patches are necessary."

Yet embedded systems will likely always take longer to patch, says Marc Brown, vice president of tools for Wind River. Many embedded device manufacturers will be able to speed up patch distribution and close security holes, especially on network-connected devices. However, more deeply embedded systems, such as industrial control and monitoring equipment, will not have an easy path to patches, he says.

"You will have high-end devices, like Android phones, that will be patchable, and low-end ones that won't be updated and so still have risk," Brown says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.