Re: potential security issues with embedded systems?

["H. Morrow Long" <morrow.long () YALE EDU>]

Kyle -- Many of the new 'building automation systems' being deployed by
           facilities and construction management folks feature
full-blown
       embedded OSes, often with SNMP and/or embedded webservers
       included for management.

       Many of these systems are used for monitoring temperature, off/on
       status and other sensor output -- but they can often also be used to
       control the device under monitoring/management as well.

       While these devices used to be on proprietary networks in the past,
       or even just on closed systems with RS232/422/etc, now they are
       often on IP-based Ethernets (and many enterprises may possibly
       use their regular enterprise network to connect these devices for ease
of
       access....).

       Johnson Controls is deploying various new hardware systems with
       Windows XP Embedded (deployed to fit on a 256MB Flash RAM card).
       They include an embedded web server as well.  For more info see the
       MS PR article on Johnson Controls use of Windows XP Embedded in
Metasys:
       http://www.microsoft.com/windows/embedded/xp/evaluation/casestudies/
casestudy.asp?CaseStudyID=13890

       Siemens (hqtrd in the .DE domain) uses a different embedded OS
       (Nucleus I believe) as the embedded OS for most of their building
       automation control systems.  They are planning on coming out with
       optional embedded web servers in some of their devices in 2004.

       Don't know about Honeywell-Bull (another big player in this market)
       but it would be interesting to hear what their embedded OS(es) is or
       are planned to be.

       I wouldn't be too surprised to see embedded Linux OSes used in this
       market either -- to my knowledge a number of the DVD players, DVRs,
       cable set-top boxes (and the converged units being planned and built
       which combine a number of these features) are based on embedded
       Linux OSes -- my digital cable box from Comcast periodically gets into
       a mode where you can see the Linux kernel boot  (and then you can
       often watch the unit acquire an IP address via DHCP and try to download
       a new OS image, updates and configuration changes).

       In the past apparently there were a number of vendors from the
real-time
       OS crowd (RTOS, LynxOS, QNX) who made ROMable OSes suitable for
       embedding in devices  (and charged licensing and royalties for the use
of
       their specialty OSes).  I presume that they are still available and
active
       but may be worried about encroachment from the embedded versions of
       the more general purpose OS crowd (Windows XP Embedded and Linux
       stripped-down variants).

- H. Morrow Long


On Dec 11, 2003, at 2:42 PM, Kyle Barger wrote:

> The recent story about Diebold teller machines being hit by the Nachi
> worm
> started me thinking.  In the past few months I've seen demonstrations
> of a
> PBX system and of a "one card" debitcard/building access system that
> were
> both based on Windows.
>
> We all know what we've had to deal with in terms of security issues for
> Windows as a server and desktop OS.  What has the track record been for
> embedded systems that use Windows?  Is this enough of a concern to take
> such products out of the running for future consideration?  What about
> other operating systems?  If I buy a firewall appliance that's built on
> Linux, should I worry about how fast the vendor will be releasing
> firmware
> upgrades to handle Linux security issues that crop up?
>
> Any experiences or thoughts are appreciated.
> --
> Kyle Barger        Manager of Computing & Telecom Services
> kbarger () ltsp edu   The Lutheran Theological Seminary at Philadelphia
>
> **********
> Participation and subscription information for this EDUCAUSE
> Discussion Group discussion list can be found at
> http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

Attachment: smime.p7s
Description: