Re: [Suit] How are firmware and firmware versions expressed in manifest?

[Hannes Tschofenig <[e-mail]>]

I guess we have to wait and see how this will play out. My understanding is that the manifest can accommodate for all sorts of meta-data attachment and from that side we are doing fine.

Ciao
Hannes


From: Eliot Lear <[e-mail]>
Sent: Tuesday, June 9, 2020 11:27 AM
To: Hannes Tschofenig <[e-mail]>
Cc: Michael Richardson <[e-mail]>; [e-mail]
Subject: Re: [Suit] How are firmware and firmware versions expressed in manifest?

Hannes


On 8 Jun 2020, at 13:27, Hannes Tschofenig <[e-mail]<mailto:[e-mail]>> wrote:

I have to look at the links Eliot shared but I hope that people are not overly excited about the value of having information about what software version is on their devices for the purpose of drawing security conclusions. You have been at many hackathons where we created firmware for Cortex M-class devices and we used, for example, Mbed TLS in many instances. Does this tell you anything about the security? Can you draw conclusions when you hear that version X has a security vulnerability? Should you be concerned when a security researcher was able to mount a fault injection attack against a specific MCU with a specific version of Mbed TLS running on it? No, not really because you have to know what compile-time configurations were used to build the firmware, what hardware it is running on and what run-time configuration is present.

Actually, the people who should be concerned are the manufacturers, who are going to receive calls from customers who have learned that the manufacturer used EmbedOS but didn’t know that the option in a particular device is disabled.  This is an aspect of SBOMs that is understood to be problematic, and so discussion is gradually shifting to something they call Vulnerability EXchange (VEX) (I hate the name, but as someone who created something called MUD I have no real leg to stand on).  The idea behind VEX, fuzzy as it is, is that one would be able to query to determine if the manufacturer has investigated and affirmatively determined whether a particular product has a particular vulnerability.  I like the concept, because in industrial much of the tooling is already flagging quite a lot of false positive CVEs.

Eliot
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.