Re: [Suit] Common firmware update flaws

[Brendan Moran <[e-mail]>]

Hi Fabien, Hi Hannes,

A list of common practices that are insecure was originally brought up in the TSVART review of draft-ietf-suit-architecture (https://datatracker.ietf.org/doc/review-ietf-suit-architecture-11-tsvart-lc-briscoe-2020-08-09/). I don’t understand what purpose it serves because this is exactly the point of the information model. Or, more specifically, the threat model that is in the information model. It lists all firmware-update-specific attacks (that we could think of, but it’s pretty exhaustive). I’d rather avoid the duplication caused by adding a threat model to the architecture when there’s already a threat model in the information model.

See below for more.

Best Regards,
Brendan

> On 17 Sep 2020, at 19:01, Fabien BESSIERES <[e-mail]> wrote:
>
> Hi,
>
> Here is my feedback :
>
> Question 1: I believe that the architecture document could include a list of common practices that are insecure.

[BJM]
I don’t understand what purpose this would have. Common insecure practices are well covered already. You can find a full threat model in the companion to the architecture: the information model. (https://datatracker.ietf.org/doc/draft-ietf-suit-information-model/)

This doesn’t exclusively list anti-patterns, but it does list threats, which are intimately related to anti-patterns.

If you would like examples of real-world attacks that exploit insecure practices in IoT devices, we can reference Annex D of the ENISA baseline security requirements for IoT devices. If you would like a list of good practices, we can reference Annex A of the ENISA baseline security requirements for IoT devices.

https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot
[/BJM]

> Question 2: (a) I don't see any problem in adding directly referenced to published flaws.
> (b) But yes it should be examples that are fixed with the SUIT manifest
>
> I believe that addressing common mistakes/errors/flaws is one of the goals of the architecture, so it should appear in the document. What do you think ?

[BJM] as above, I think this is already well-covered. Unless we’ve got something new to add, should we not just reference the information model and the ENISA baseline security requirements for IoT devices?

> Fabien
>
> Le jeu. 17 sept. 2020 à 08:58, Hannes Tschofenig <[e-mail]> a écrit :
> Hi all,
>
>
>
> In his review, Bob Briscoe suggested to list “common practices that are insecure, and perhaps some common misconceptions about secure firmware update” in the SUIT architecture document.
>
>
>
> So far, nobody suggested to include such a list in the architecture document and hence I would like to reach out to the group.
>
>
>
> There are different ways to write such a text and the key decisions are:
>
>
>
> • Should we include references to published flaws or keep the description abstract?
> • Should we include only examples that we later fix with the SUIT manifest? For example, a firmware update can change the nature of a product (e.g. excluding the use of third party printer cartridges).
>
>
> Question 1: Would you like to have such text to be added?
>
>
>
> Question 2: If so, what is your answer to (a) and (b)?
>
>
>
> Your feedback is appreciated. Text contributtions are welcome!
>
>
>
> Ciao
>
> Hannes
>
>
>
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> _______________________________________________
> Suit mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/suit
> _______________________________________________
> Suit mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/suit

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.