Security for embedded devices

New features added to the LynxSecure separation kernel help protect embedded systems from advanced cyber threats

LynuxWorks are adding new security features to the LynxSecure embedded hypervisor to offer real-time detection, alert and protection against new cyber threats - including zero-day rootkits and bootkits. As more embedded devices are connected to the outside world, as well as being connected to each other (machine-to-machine), the more they are vulnerable to malicious cyber threats seeking to threaten critical infrastructure, financial infrastructure and corporate domains.
LynxSecure is based on separation kernel technology and was designed from the ground up with security as a key design goal. Adding virtualisation to the separation kernel allows for multiple different guest operating systems (OS), both real-time and general purpose, to run in secure domains on a single embedded system. LynxSecure 5.2 is the latest version of this established product and adds a new feature that offers real-time detection of stealthy advanced persistent threats such as rootkits.

Rootkits are the most sophisticated and lethal type of malware--stealthy and extremely potent. A device is often infected a long time before the actual cyber attack happens, with the cyber payload being secretly injected and remaining dormant until the attack is finally triggered. When the LynxSecure 5.2 product is used on embedded devices, it can help detect these malicious infections as they inject their payload, long before the start of the actual cyber attack.

“Connected embedded devices are now becoming vulnerable to the same types of cyber attacks that we commonly see in corporate computer networks,” said Robert Day, vice president of marketing at LynuxWorks. “By using LynxSecure, with its new cyber protection mechanisms as a secure foundation between the hardware and the OS, we can help identify and protect against these attacks before the real damage is done.”

A common trend in the embedded market is that developers are starting to use more general purpose OSes, such as Windows, Android and Linux for connected devices. These general purpose OSes offer familiar user interfaces, and benefit from the wide range of applications and devices that they support. Unfortunately, this trend also adds the potential for cyber threats that have been common in the desktop, laptop and mobile arena to now attack connected embedded devices.

These most advanced variants of these cyber threats, such as rootkits, work at the lowest levels of the OS they intend to attack. The approach to combating these insidious threats needs a mechanism that offers a completely different security posture: It must execute with a higher privilege than the attacked OS; provide complete control of the platform hardware; and monitor all activities of the OS and its applications. Also, this mechanism must be self-protecting, non-bypassable and tamper-proof.

The LynxSecure product, by the nature of its virtualisation, resides beneath the OS, and allows any nefarious activity from advanced cyber threats to be observed, examined and prevented. This security architecture allows embedded developers to use general purpose OSes for their connected devices, often alongside traditional embedded RTOSes on the same hardware, with the extra protection against today’s and tomorrow’s advanced cyber threats.

• See also our ICS & SCADA Security Page for lots of links on cybersecurity in automation.

Zero-day rootkits & bootkits

New features to help protect endpoints against the most potent and stealthy advanced persistent threats

LynuxWorks has announced  announced that they will demonstrate the industry’s first technology capable of real-time detection, alert and protection against zero-day rootkits and bootkits. Rootkits are the most sophisticated and lethal type of malware--stealthy and extremely potent. When resident on endpoint devices, the LynxSecure 5.2 product can help security experts and IT staff discover rootkit infections and neutralize them, and then easily remotely clean infected machines, thereby preventing future infections.

LynxSecure 5.2 is the next version of the established secure separation kernel and hypervisor from LynuxWorks. Designed from the ground up with security as a key design goal, this military-grade virtualization solution is now available for Enterprise users. It is small, secure and offers high performance that is well suited to today’s modern roaming endpoints, such as laptops and hybrids. Now adding a feature that does real-time detection of stealthy advanced persistent threats such as rootkits, brings the use of this technology to the front of Enterprise security protection.

“This new feature in LynxSecure 5.2 really shows off the power of using virtualization technology to protect endpoints,” said Robert Day, vice president of marketing at LynuxWorks. “We will be demonstrating several examples of LynxSecure protected endpoints including live defense of a real rootkit.”

Rootkits work at the lowest levels of the operating system (OS) they intend to attack. Thus, it is a self-defeating cause to try and have a detection and prevention mechanism that is a part of the “target of attack.” The approach to combating these insidious threats needs a mechanism that offers a completely different security posture: It must execute with a higher privilege than the attacked OS; provide complete control of the platform hardware; and monitor all activities of the OS and its applications. Also, this mechanism must be self-protecting, non-bypassable and tamper-proof. LynxSecure provides a comprehensive end-to-end solution, fully manageable by IT staff, while providing a detailed real-life picture of the rootkit infections in the corporate network.

“Rootkits are not only the most dangerous cyber-threat, but also the most common one. Daily we witness new cyber-attacks on major corporations, media companies and government agencies. What’s common to these attacks is that the targets are endpoints and that the malicious payloads are rootkits and bootkits.” said Avishai Ziv, vice president of Enterprise Security solutions at LynuxWorks. “The existing dedicated tools for detecting and removing rootkits and bootkits are very few, provide only partial remedy and require a lengthy, complicated process. Our technology is the only one capable of handling the entire cycle while the endpoint is still active, with swift, remote remediation.”

Flying high in business jet!

LynuxWorks tells us that LynxOS-178 is flying high. The recent announcement by Rockwell Collins that its Pro Line Fusion® integrated avionics system that uses LynxOS-178 is now in service on the Gulfstream G280™, marks the system’s debut in the super mid-size business jet market segment.

“This deployment is a major step in the continued widespread use of LynxOS-178 in avionics systems,” stated Robert Day, Marketing VP for LynuxWorks. “New market segments, such as the business jet market, further expand the reach of standards-based software and benefit from the software’s ability to reduce the time and cost of platform development and its subsequent certification.”

Earlier this year, LynuxWorks received Advisory Circular AC 20-148 approval from the FAA for reusable software components (RSC) authorized for the LynxOS-178 product used in the Rockwell Collins Adaptive Flight Display Runtime, Common Computing Module Runtime, Data Concentration Module Runtime and Synthetic Vision Module Runtime for Pro Line Fusion.