Hands-On Ethical Hacking and Network Defense, Third Edition 9-1
Chapter 9
Embedded Operating Systems: The Hidden Threat
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
Hands-On Ethical Hacking and Network Defense, Third Edition 9-2
Lecture Notes
Overview
This chapter provides an introduction to embedded operating systems. Students will learn what
embedded operating systems are, how to identify vulnerabilities, and practices used to protect
them. These devices shouldn’t be ignored simply because they’re small, perform simple tasks,
or haven’t been exploited in the past. Security professionals should understand that any
vulnerability in a desktop or server OS might exist for its embedded counterpart.
Chapter Objectives
After reading this chapter and completing the exercises, the student will be able to:
• Explain what embedded operating systems are and where they’re used
Teaching Tips
Introduction to Embedded Operating Systems
2. Describe embedded operating systems. This type of system can be a small program
3. Discuss a real-time operating system (RTOS), which is a type of specialized embedded
4. Mention that with just a cursory survey of a typical corporate building, you can find
5. Explain that embedded systems are in all networks and perform essential functions, and
that their security should not be dismissed.
6. Point out that as the value and quantity of targets with embedded systems increase,
Hands-On Ethical Hacking and Network Defense, Third Edition 9-3
Windows and Other Embedded Operating Systems
2. Discuss the difference between Windows CE and Windows Embedded 8/Windows 10
IoT.
4. Point out that you can run some vulnerability assessment tools on an embedded OS.
There are also others that can be used remotely from the network to discover
vulnerabilities in a Windows embedded OS.
Teaching
Tip
Go to http://www.microsoft.com/windowsembedded/en-us/default.mspx for
information on Windows embedded devices.
Other Proprietary Embedded OSs
1. Explain that VxWorks is an embedded OS widely used in many different environments
and applications. It is designed to run efficiently on minimal hardware. Here is a partial
list of systems using VxWorks:
a. Clementine spacecraft
b. Deep Impact space probe
c. James Webb Space Telescope (in development)
2. Mention that Green Hill Software also produces a variety of embedded OSs.
4. Discuss QNX, a commercial RTOS used by Cisco and Logitech.
Hands-On Ethical Hacking and Network Defense, Third Edition 9-4
6. Using Figure 9-2, explain the difference between monolithic kernel and microkernel
*Nix Embedded OSs
1. Explain that Linux is an example of a monolithic OS used in a multitude of industrial,
medical, and consumer items.
3. Discuss the other versions of embedded Linux OSs (e.g., Real Time Linux and dd-wrt).
Teaching
Tip
Visit http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-0075 for information on
embedded operating system applications.
Quick Quiz 1
1. At its most basic, any computer system that isn’t a general-purpose PC or server can be
described as which of the following?
A. real-time operating system
B. network attached storage device
C. embedded system
D. firmware
2. What is a type of specialized embedded OS that is typically used in devices such as
programmable thermostats, appliance controls, and even spacecraft?
3. True or False: Embedded systems are in all networks.
4. Software residing on a chip is commonly referred to as which of the following?
A. real-time operating system
B. network attached storage device
C. embedded system
D. firmware
5. What is a type embedded OS certified to run multiple levels of classification on the
same CPU without leakage between levels?
Vulnerabilities of Embedded OSs
1. Explain that impacts of computer attacks are becoming more serious, including those
targeted towards embedded systems.
2. Discuss the goal of many hackers today (i.e., ways to steal money).
Teaching
Tip
Visit the following link for an article about eliminating embedded system software
vulnerabilities:
http://www.embedded.com/design/system-integration/4006645/A-proactive-
strategy-for-eliminating-embedded-system-software-vulnerabilities-Part-2
Embedded OSs Are Everywhere
1. Explain that today there are many more embedded devices that in 2000. They don’t
Embedded OSs Are Networked
2. Discuss the questions that should be addressed by security testers for every machine or
device on a network:
a. What PCI devices are present?
b. Where were they manufactured? Is the supply chain trustworthy?
c. Which devices have embedded OSs stored in rewriteable (nonvolatile) memory?
d. Which embedded OS is currently loaded on each device?
e. Can you make sure the embedded OS hasn’t been corrupted or subverted with
malicious code?
Embedded OSs Are Difficult to Patch
1. Explain that embedded devices are difficult to patch because they must continue
operating regardless of threat.
2. Mention that security testers must weigh the costs of fixing a vulnerable system against
the importance of the information the embedded system controls.
Hands-On Ethical Hacking and Network Defense, Third Edition 9-6
Embedded OSs Are in Networking Devices
2. Mention that high-speed networks now use specialized hardware and embedded OSs.
Embedded OSs Are in Network Peripherals
1. Review the most common peripheral devices on an organization’s network (e.g.,
3. Using Figures 9-6 and 9-7, demonstrate how to set up custom links and modify
firmware being uploaded on a Dell networked printer.
Security
Tip
Visit http://cseweb.ucsd.edu/classes/fa01/cse221/projects/group2.pdf for a paper
that presents a survey of several major embedded operating systems.
Supervisory Control and Data Acquisition Systems
1. Describe supervisory control and data acquisition (SCADA) systems, which are used
Cell Phones, Smartphones, and PDAs
1. Explain the additional vulnerabilities of cell phones, smartphones, and PDAs.
Rootkits
1. Discuss how rootkits function. They can modify parts of the OS or install themselves as
2. Mention that rootkit-detection tools and antivirus software can detect and prevent
Best Practices for Protecting Embedded OSs
1. Review the following best practices for protecting embedded OSs:
a. Identify all embedded systems in an organization.
b. Prioritize the systems or functions that depend on these embedded systems.
Teaching
Tip
Read about securing the Internet of Things at http://www.lynx.com/.
Quick Quiz 2
1. As a security tester, you need to remember that sometimes the biggest security threat to
an organization is which of the following?
A. outdated software
B. employees
C. embedded systems
D. real-time operating systems
2. On the eve of the past millennium, experts warned of an imminent global catastrophe:
Billions of embedded systems with a software flaw known as which of the following?
A. RTOS
B. IoT
C. Y2K
D. WES
3. True or False: It is easier to detect a rootkit if the system comes already compromised.
4. True or False: Embedded OSs must continue to operate regardless of threat.
5. What is a popular laptop theft-recovery service that has some design-level
vulnerabilities that rootkits can exploit?
Class Discussion Topics
2. Identify and discuss the different types of embedded systems currently in your
classroom. What other embedded systems exist in the building?
Additional Projects
1. Ask students to investigate types of embedded OSs installed in products they own.
2. SCADA systems are used for critical infrastructure systems. Have your students
research various applications of SCADA systems employed today. Can they find a
SCADA system that has been damaged? If so, what were the consequences?
Hands-On Ethical Hacking and Network Defense, Third Edition 9-9
Additional Resources
1. Embedded Products OS/Software:
2. Embedded Website:
5. Embedded System Security:
Key Terms
See Glossary for definitions of Key Terms.
➢ embedded operating system (OS)
➢ embedded system
➢ firmware
Technical Notes for Activities
Activity 9-1: This activity requires a computer running Windows, an Internet connection,
and a Web browser.
Hands-On Ethical Hacking and Network Defense, Third Edition 9-10