- Introduction
- Why Hack Embedded Devices at All?
- Embedded Devices with Customizable Firmware
- Firmware OptionsFirmware Options
- Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Why Hack Embedded Devices at All?
Why bother with hacking an embedded device, when so many other technological options are available that might not require as much effort? Because embedded devices offer some really attractive features:
- They’re inexpensive.
- They don’t consume much power.
- They don’t generate much heat.
- They’re small, so they save space.
- They teach a minimalist approach that can be helpful in other areas of your technology.
- Remote access allows you to put the embedded device almost anywhere.
Inexpensive Equipment
Building an IT infrastructure, a security lab/playground, or a security testing platform can get expensive. Even small offices need some sort of IT infrastructure, perhaps something as simple as a DHCP/DNS server and central file server for important documents. The cost of a server that’s dedicated to this task can be daunting, especially when compared to the low cost of an embedded device that can accomplish the same task.
Recently, I was doing some work for an office with fewer than 10 employees. An internal DHCP and DNS server can provide some great benefits for this type of environment:
- Static assignment of IP address via MAC address
- "Black hole" ad domains to speed up Internet connections and provide protection against malicious web sites
- Creation of an internal domain to provide name resolution for internal servers and devices
Rather than deploying a Windows or Linux server (or even a pair for redundancy), you can accomplish all of these functions for approximately $200, simply using two embedded devices. These embedded devices also have a USB port for attached storage, so they can act as the file servers, too!
Embedded devices are also great if you want to devote a device to a dedicated task. For example, sniffing wireless networks normally requires a laptop, PCMCIA wireless card, and some sort of external antenna. This gear is expensive, as it not only can sniff wireless networks, but is also providing the functionality of a personal computer.
On the other hand, embedded devices can be used for wireless sniffing, and the base model can be purchased for as little as $60. Whether you’re looking to deploy wireless sniffers, DHCP/DNS servers, or network-attached storage, you should consider using an embedded device. The best part is that you don’t have to build your own circuit board (or work with a company to build one); you can use inexpensive, off-the-shelf hardware to do all of those tasks!
Power Savings
If you’re a resident of California, you’re likely well aware of that state’s power consumption problems, and may have been affected by "rolling blackouts." In addition to the larger resource issues associated with providing power, there’s a cost factor. Whether it’s a small upgrade in your home, or a dedicated 30 amp circuit in your co-location, power renovations can be expensive.
In the quest for more efficient and less expensive power, many organizations have turned to embedded devices. While drawing as little as .5 amps, some embedded devices can provide the same functionality as a server with a 500W power supply drawing 10 amps. I’ve experienced this situation in my own homes, including one that was more than 50 years old and another that’s less than 10 years old. In both cases, I needed to upgrade the electricity to support servers and computers in use at my home lab. It’s pretty common for IT geeks to have a lab at home—especially security professionals who like to tinker and hack various technologies, or to practice penetration testing.
You can cut power consumption significantly by using embedded devices. You may still need servers and computers around for more serious computing tasks; however, you can move the supporting services (DHCP/DNS, network-attached storage, and so on) to embedded devices. This technique may help you to avoid having to upgrade power in your home or office, and can certainly reduce your electric bill. It’s expensive to install and maintain enough power for servers and desktops, including providing the appropriate amount of UPS battery power to protect your computers from power spikes and outages. Embedded devices draw much less power (typically only a couple of watts), and due to the flash-based storage, disk damage due to power failure is less of a concern.
Easy Cooling
Servers, desktops, and laptops generate an enormous amount of heat, making labs or server rooms very hot without proper cooling. Embedded devices generate much less heat; many can be placed in a closet without much concern that they’ll overheat.
Small Footprint
Rack space is expensive, whether you’re maintaining your own or renting. The cost of maintaining a rack or building a datacenter is huge, but with embedded devices you can cut those costs considerably. Using embedded devices instead of full servers can shrink the size of your datacenter. This is especially important in small businesses, where servers may not even have a dedicated rack space.
Minimalist Approach
Working on embedded devices as a developer—even if you’re just porting software or creating custom firmware builds—teaches you to be a minimalist. When you’re working with only 4MB of storage space, which is common for embedded devices, every byte counts. This environment gives you an appreciation for efficiency that can be carried into other areas of technology, with some big benefits. For example, the kernel size must be managed to keep it from growing too large. This skill can be applied to your servers and/or workstations as well, to increase performance on those platforms.
This approach also has a very positive effect on security; because you include only the functionality that you need for operation, your devices won’t have unnecessary services that offer attackers hacking opportunities.
Remote Access
Once you’ve packed all of this functionality into an embedded device, the "sexy" part comes when it’s time for deployment. You can hide an embedded device in a customer network, within another device, under the seat of your car—even make it look like a plant, if you want to get really creative. For example, you can deploy a wireless monitor just about anywhere you can run an Ethernet cable.