auditing-ota-and-firmware-update-channel-trustlisted

# Auditing OTA and firmware update channel trust: whatever a device installs, it runs forever A firmware update is the most powerful thing that can happen to a device: whatever image it installs becomes the code it runs, persistently, with full control of the hardware. So the update channel is the highest-value boundary on the device, and the only thing standing between an attacker and permanent control is whether the device verifies an image before it installs it. The failures are a checklist of that verification. If the device does not verify a cryptographic signature over the image against a key it trusts, an attacker installs arbitrary firmware. If it fetches the image over an unauthenticated transport, an on-path attacker swaps the image in flight even if the server is honest. If it does not enforce version monotonicity, an attacker rolls the device back to an older, still-signed image with known vulnerabilities and re-exploits it. If it trusts an update server or manifest URL without authenticating it, an attacker who controls or spoofs that endpoint feeds it a malicious image. And an unencrypted image leaks embedded secrets and hands a reverse engineer the code. The audit follows an update from where the device learns of it to where it installs it and checks that the image is signature-verified, transport-authenticated, and version-monotonic before it ever runs. You audit this by trying to get the device to install an image it should refuse. ## When to use - A devic