Embedded security testing for firmware and connected devices

Delta reads the security state of an embedded Linux device: open ports, persistence files, accounts, packages, binaries and kernel modules. Midair compares it with the accepted baseline and lists what changed.

Scan the firmware image before it ships. Then watch the same surfaces on the running device.

Join the waitlist Explore the attack surface

delta · gw-lab-2 · cycle 4415 Example

$delta --cfg golden.json --binaries / --json
port       4444/tcp LISTEN nc      appeared
persistence/etc/cron.d/backup 0666  T1053.003
account    UID 0: svc_backup       T1136.001
package    busybox 1.31.1          CVE-2021-28831
hardening  /usr/bin/agent          no stack canary
module     diag_hook               T1547.006
risk       grade D, 6 violations, exit 1

What embedded security testing is.And why it needs the device.

Embedded security testing checks what an attacker could reach on a device, and whether that changed since the last known good state. It covers the services a device exposes, the software it runs and how that software was built.

Most of this only shows in the built image or on the device. The source does not say which port a package opens or which cron job an installer left behind. Nor does it show which binary lost its stack canary in a toolchain update.

Delta reads these surfaces from a firmware image or from a live device. It reports the differences from a baseline that you accepted. It classifies nothing on its own and changes nothing on the device.

The attack surface of a device.Six layers, from the network down to the kernel.

Pick a layer to see what Delta reads there. Switch between the baseline and the current state to see what appeared and what went missing.

reached from the network

inside the kernel

Open ports

What Delta readsListening ports with protocol, state and the process that owns them. A norm can limit which ports may be open.

Example

In the baseline

• 22/tcp LISTEN dropbear
• 443/tcp LISTEN nginx
• 1883/tcp LISTEN mosquitto

Appeared 1

• 4444/tcp LISTEN nc

Missing 0

• nothing

Persistence files

What Delta readsCron, systemd units with their *.wants links, init scripts and shell profiles. Each entry carries a MITRE ATT&CK technique id. A world-writable persistence file is critical even without a baseline.

Example

In the baseline

• /etc/crontab
• /etc/init.d/S50nginx
• /etc/profile

Appeared 2

• /etc/cron.d/backup mode 0666 T1053.003
• multi-user.target.wants/updater.service T1543.002

Missing 0

• nothing

Accounts and keys

What Delta readsAccounts with UID 0 in /etc/passwd, and the number of keys in each user's authorized_keys. Any UID 0 account other than root is critical.

Example

In the baseline

• UID 0: root
• root: 1 authorized key

Appeared 2

• UID 0: svc_backup T1136.001
• root: 2 authorized keys

Missing 1

• root: 1 authorized key

Packages and CVEs

What Delta readsInstalled packages from dpkg, opkg or apk, as a software bill of materials (SBOM). Delta matches them against a local CVE feed that you supply, for example one built from OSV.

Example

In the baseline

• busybox 1.36.1
• openssl 3.0.13
• dropbear 2022.83

Appeared 1

• busybox 1.31.1 CVE-2021-28831

Missing 1

• busybox 1.36.1

Binaries and hardening

What Delta readsFor each ELF file: architecture, libc, linked libraries, toolchain, and NX, PIE, RELRO, stack canary, FORTIFY and stripped. A hardening policy can require each mitigation.

Example

In the baseline

• /usr/bin/agent NX PIE RELRO canary
• /usr/sbin/nginx NX PIE RELRO canary

Appeared 2

• /usr/bin/agent csum 9f2c…e10c
• Binary '/usr/bin/agent' lacks required mitigation: stack canary

Missing 1

• /usr/bin/agent csum 41ab…07c2

Kernel modules

What Delta readsLoaded kernel modules and /etc/ld.so.preload. Delta flags a module that is not in the baseline. A preload file that is not empty is critical.

Example

In the baseline

• 8021q
• nf_conntrack
• wireguard

Appeared 1

• diag_hook T1547.006

Missing 0

• nothing

In Midair, Accept as baseline adds a difference to the baseline. Watch this again removes an entry, so the device reports it again.

Firmware image or live device.The same checks, before and after it ships.

With --root, Delta reads a mounted firmware image or an unpacked rootfs without booting it. Nothing runs inside the image. Mount or unpack it first, for example with mount -o loop or unsquashfs.

Surface	Firmware image (--root)	Live device
Packages and CVEs	From the package database in the image	From the package database on the device
Binaries and hardening	Every ELF file in the image	Every ELF file on the device
File checksums and persistence files	Yes	Yes, plus a check that system persistence files belong to root
Golden baseline	Captured from the image	Captured from the device
Processes and open ports	None: an image runs nothing	Yes
Network interfaces	As declared in the image configuration	As they are, including promiscuous mode
Mounts	From /etc/fstab	As mounted

Built for the device.One static binary per architecture.

Midair asks for the operating system and the CPU architecture of each device. It builds Delta for that platform and deploys it over SSH.

about 104 KBThe smallest build of the agent, optimised for size and stripped.

x86

x86_64

ARM

aarch64armv7 hard-floatarm hard-floatarm soft-float

RISC-V

riscv64riscv32

MIPS

32-bit big-endian32-bit little-endianhard- and soft-float64-bit n64 and n32, both byte orders

The Linux builds are static musl binaries, so they need no libc on the device. A report-only build leaves out all code that can change the host.

Questions.Short answers.

What is embedded security testing?

Embedded security testing checks what an attacker could reach on a device: open ports, accounts, installed packages, persistence files, binaries and kernel modules. It also checks whether any of these changed since a known good state.

Can Delta scan a firmware image without a device?

Yes. With --root, Delta reads a mounted image or an unpacked rootfs without booting it. It checks packages, files, binaries and persistence files. Processes and open ports need a running device.

Does Delta change anything on the device?

Not on its own. Delta reports differences from a baseline or a policy. Any action on the host needs an explicit command, and a report-only build has no code that can act at all.

How does Delta find known vulnerabilities?

Delta reads the installed packages from dpkg, opkg or apk and matches them against a local CVE feed that you supply. A tool converts OSV records into that feed and exports the inventory as CycloneDX 1.5 or SPDX 2.3. Delta does not read the rpm database.

Which devices can run Delta?

Linux devices on x86_64, ARM, RISC-V and MIPS, as static binaries. Midair builds the agent for the architecture of the device and deploys it over SSH.

How is this different from cybersecurity testing?

Our cybersecurity testing page follows a weakness from the code to a test to the device. This page covers the device itself: what it exposes and what changed.

Related pages.Capabilities and reading.

From code to deviceCybersecurity testingThe attack vector loop: analyse, plan, write tests, run and judge. CapabilityFirmware testingFlashing, boot and recovery tests on real boards. CapabilityNetwork hardware testingConnected devices under real traffic and network conditions. CapabilityHardware-software integration testingFailures where software, firmware and hardware meet. Before the boardStatic analysis for embedded systemsVisao on embedded C and C++, before the code reaches a device. Embedded testing diaryReproducible testsHow resets, device state, network isolation and run fingerprints make two runs comparable.

Start with one device.Or one firmware image.

A pilot captures a baseline of your image or your device and shows what changes between builds.

Join the waitlist