As a rich operating system environment, Linux provides standard tools to implement robust, and auditable security policies together with many security hardening options.
This course covers security topics and technologies widely used to help secure Embedded Linux systems.
Attendees will learn how teams can manage their security as a top-down process using a secure development lifecycle methodology.
The Yocto build system is used to illustrate how security choices (compiler options, container settings, access control models, etc.) can be implemented at a distribution level.
Linux is also a rich environment for adversaries who are likely to invest time to compromise an embedded Linux target, in order to establish a versatile and persistent presence. To this end the course will also help teams identify and manage common vulnerabilities and exposures (CVEs) through the use of well-known testing and vulnerability assessment tools.
The course also investigates platform security features such as secure boot and trusted execution environments (TEEs) using a QEMU emulator.
The practical side of the training is based around carefully designed exercises, investigating security features and issues for a real embedded system, to reinforce and challenge the extent of learning. These comprise approximately 50% of class time.
If you have specific security application requirements, please contact the Doulos team to discuss your options.
Embedded Linux developers, architects, testers working on projects which need to be secure.
“Practical Embedded Linux Security” is aimed at electronic hardware, software and system-on-chip engineers who need to gain a working knowledge of the software and operating system security issues affecting Linux based embedded systems.
Please note: this is not a course on bare metal security issues affecting microcontrollers. Delegates wishing to learn more about that topic are recommended to take the Doulos Embedded System Security for C/C++ Developers course.
Delegates should be familiar with and have some experience of working with embedded Linux systems, e.g. completion of Developing with Embedded Linux training or equivalent working knowledge.
The Linux distribution used in the practical exercises has been built using the Yocto Project build system. There are no advanced Yocto configuration tasks required in these and the core concepts will be introduced during the training. A basic understanding of how the Yocto Project is used to build a Linux distribution is preferred. The short instructions found in the Yocto Project Quick Build online documentation are sufficient.
Delegates should also have knowledge of the C or C++ programming language and embedded system architecture. In particular a basic level of familiarity with functions, variables, data types, operators, and statements.
The Doulos C Programming for Embedded Systems courses provides appropriate preparation for engineers who lack this experience.
Please contact Doulos directly to discuss and assess your specific experience against the pre-requisites.
Doulos training materials are renowned for being the most comprehensive and user-friendly available. Their style, content and coverage are unique in the Embedded Systems training world and have made them sought after resources in their own right. The materials include:
Security and trust • Attack model - threats, vulnerabilities, and exploits • CVEs and CWEs • In the news
Practicals: Look at the CVEs found in a Yocto build system with cve-check enabled. Find the severity of the vulnerabilities flagged as "unpatched".
Filesystem Security • Privileges • Capabilities
Practicals: Explore the impact of the GTFOBins binaries when associated with elevated privileges or capabilities. Look at how access control lists can further limit access to files.
Loading an ELF file into memory • Working with the stack • Dynamically linked libraries • Top CWEs 2020 (buffer overflow, command-line injection, integer overflow)
Practicals: Sample code containing a standard memory vulnerability can be exploited to run arbitrary code. Explore the effects of GCC compiler security options. Verify that binaries can automatically be inspected for security compiler options with the checksec script provided in the Yocto meta-security layer.
Block and Stream ciphers • Key exchange (DH, ECDH and RSA) • Data integrity (Hashes and HMAC) • Signatures & Certificates
Practicals: Perform the following tasks using OpenSSL. Create and test custom Diffie-Hellman parameters for a server. The Yocto build system includes recipes to build the crypodev kernel module
Kernel vulnerabilities • The Linux Self Protection Project • Kernel hardening configurations
Practicals: Standard Linux distributions and the kernel self-protection project recommend a variety of security hardening configurations. Using tools from the Yocto meta-security layer, establish that it is possible to manage required secure configurations with-in the distributions build system.
Authentication, authorization and Access Control • Access control models • Security Policies • SELinux and SMACK
Practicals: The Yocto build system can be used to build a distribution with either SMACK or SELinux support. First, we will use a custom SMACK policy rule to limit access to a file. We next explore how certain SELinux policy rules can be tuned with Boolean values. Finally, we extend a targeted policy by building a custom SELinux policy to control accesses for a new application.
Namespaces and Cgroups • Characteristics of a container • The LXC tools
Practical: Creating and comparing the effectiveness of full containers and application containers, when isolating a vulnerable FTP server.
Secure & measured boot • Trusted execution environments (Trustzone) • OTA update frameworks • U-boot hardening configurations
Practicals: Looking at the OP-TEE build system, modify an existing TA to decrement a counter and run it on the QEMU emulator.
Linux Filesystem Integrity Checks - IMA, EVM • dm-verity, fs-verity & dm-integrity • dm-crypt, fscrypt • OTA update frameworks
Practical: Contrasting the use of fscrypt and dm-crypt to encrypt data on a Linux filesystem.
Network layers • Firewalls • TLS • VPNs
Practicals: A publicly, accessible, and un-patched FTP server has been found on the target. Modify the target's network settings to enable access to the service exclusively through a VPN.
Risk and Security assessment • Threat modelling • Coding Standards and code reviews • Managing vulnerabilities
Practicals: Use the CPP check static analysis tools to explore known non-compliant code from the CERT C coding standard. Use a threat modelling tool to help automate threat reports.
FIDS and NIDs • Vulnerability scanners • Software Exploit frameworks • Hardware/ side-channel attacks • Fuzzing
Practicals: Identify software versions of services running on a target. Explore the use of exploit frameworks to test for security risks. Build and install testing and monitoring tools from the Yocto meta-security layer.
For on-site, team-based training, please contact Doulos about tailoring this course to suit your particular hardware and software environment.
Complete an enquiry form and a Doulos representative will get back to you.
Enquiry FormPrice on request