Beveiligingsanalyse van Geconnecteerde Ingebedde Apparaten

Embedded devices are a ubiquitous and ever-growing part of our society. The number of embedded devices, and their deployment in safety-, privacy- and security-critical environments is rapidly increasing. According to the European Union's Cyber Resilience Act, it is a matter of public interest that these device ecosystems are secured, as failing to do so can impact the economy, democracy, and consumer safety. In this thesis we identify critical and impactful flaws in sophisticated real-world devices used across different sectors. By documenting these weaknesses and our methodologies, we contribute to a deeper understanding of embedded security challenges and the techniques available to adversaries. Throughout this work we apply a wide variety of techniques including radio frequency and software reverse engineering, side-channel analysis, and fault injection. Through the application of these techniques in realistic scenarios we unveil security vulnerabilities affecting millions of devices. Additionally, we adapt and expand on these techniques to improve and demonstrate their practical applicability. In several cases we have built custom equipment to demonstrate the practical applicability of the discovered vulnerabilities. These demonstrations were widely covered across various local and international media channels. This allowed us to raise public awareness, disseminating our findings beyond academic circles and highlighting the importance of embedded security to a wider audience. We identified flaws in several automotive security systems and bypassed security features of multiple embedded processors. Through two custom demonstrators, we showcased flaws that allowed unlocking and starting vehicles. We developed a portable side-channel attack targeting a static key transfer operation. We evaluated the susceptibility of a series of microcontrollers against non-invasive physical attacks, and documented our analysis methodology. We built a custom printed circuit board capable of performing voltage fault injection on a hardened ROM bootloader. %, and demonstrated the capability to dynamically switch decoupling capacitors. We note that although advanced and expensive commercial equipment exists, we primarily used low-cost equipment accessible to hobbyists. This further underscores that the current state of embedded security in many devices leaves substantial room for improvement.