Earlier this month, attackers remotely took over refrigeration controllers at hundreds of French supermarkets, pushing temperatures up and spoiling food. These controllers stay in service for years, and their security depends partly on how the firmware is developed and maintained.
To support embedded and IoT developers working with firmware, SecureFlag has expanded its hands-on security training with Microcontroller Labs, also available as a learning path. The labs let developers practice finding and fixing firmware security issues in realistic device scenarios.
Microcontrollers explained
For those needing a quick refresher, microcontrollers are small computing units that manage specific tasks in electronic devices. Each includes a processor, memory, and input/output interfaces on a single chip, so they can process sensor data and control hardware like motors and heaters.
The software that runs on a microcontroller is called firmware. It is usually stored in flash memory on or next to the chip, and it is typically written in C or C++. Microcontrollers often have very limited memory and processing power, and many run without a full operating system, so developers handle tasks like memory management that other platforms handle automatically.
Microcontrollers are found in vehicles, medical devices, industrial controllers, and consumer products such as 3D printers, and are also central to many embedded and Internet of Things (IoT) systems. This makes security an important part of developing these systems.
Security challenges in firmware development
There are a few factors that make embedded systems harder to secure than conventional applications. Developers have to deal with limited computing resources and firmware that interacts directly with hardware, while also planning for devices that may remain in service for years.
Some of the key security challenges include:
-
Memory safety: Errors in embedded C and C++ code can cause memory corruption and lead to unintended behavior.
-
Secure boot: Weaknesses in how firmware is verified at startup can allow unauthorized or modified code to run.
-
Firmware updates: Inadequate checks on where an update comes from and which version it carries can allow tampering or downgrades.
-
Hardware security: Sensitive credentials and configuration data stored in external flash or other hardware components can be exposed if they are not adequately protected.
-
Hardware-facing logic: Flaws in code that interacts with sensors, actuators, and other components can affect device behavior and system integrity.
What the labs cover
In each lab, developers investigate a firmware security problem and fix its root cause. The new labs cover areas such as:
-
Input-handling flaws that expose controller data or let a flood of events stop a device from accepting commands.
-
Firmware update vulnerabilities that allow unauthorized downgrades or modifications to medical devices.
-
Safety logic flaws in electric vehicle charging systems, including incorrect handling of sensor readings.
-
Race conditions and power loss recovery errors that cause equipment such as 3D printers to operate outside safe limits.
-
Insecure storage of service credentials on external flash memory.
Build firmware security skills with SecureFlag
SecureFlag’s hands-on labs and learning paths help developers enhance their security skills in real development environments, across more than 70 programming languages and frameworks. For devices that run embedded Linux instead of bare firmware, SecureFlag also offers embedded Linux labs.
Aside from secure coding, the platform supports automated threat modeling and provides metrics so organizations can track developer security skills and measure training impact.
