New FPGA Processor Embedded Linux Kit

This new evaluation kit from Altera includes a color LCD screen with touch panel and development tools for the NIOS II processor for only $449. Multiple demos can be run from an SD card including uCLinux and graphic GUIs for NIOS.

Intel's New Embedded Processor

Intel launched a new processor for targeting high-end embedded products called the Intel Atom processor. This will be Intel's smallest and lowest power processor, but not a direct competitor to ARM processors which have lower power and cost. Intel's primary market for the new Intel Atom processor is mobile Internet devices (MIDS) and a new class of low end Internet computers and laptops. The Z5xx Series Atom processors are designed for embedded applications in markets such as automotive, medical, point-of-sale kiosks, industrial and gaming.

FTP Bounce Attacks in Embedded Servers

A potential security risk in the FTP protocol can complicate embedded systems designs. If your device implements an FTP server that strictly conforms to the FTP protocol (RFC 959), your system could be used to attack other hosts on the network. Strict FTP conformance in your product can also generate a security alert like this one for Canon multifunction printers.

The security vulnerability in FTP is known as the FTP bounce attack. If successful, it allows unauthorized access to a third party host using an intermediate FTP server (by misusing the PORT command). The attack will only occur if the intermediate server is configured to allow anonymous FTP access. There were valid reasons to allow third party access in the FTP protocol, such as sending a file from a server to a printer (FTP print server), or transferring between two servers remotely, so this security vulnerability will be present in any conforming FTP implementation.

The Canon printers in the alert already allowed you to disable anonymous ftp, or disable ftp altogether, but Canon still decided to provide a firmware upgrade through service centers that will implement a safer, but non-conforming FTP implementation. This is similar to what the OS vendors and open-source projects chose to do when the FTP bounce attack was first discovered in 1997. They still allow strict FTP conformance with a change in configuration, but the default is to prevent third party access.

Engineering Blunder Compromises Computer Security

It is well known that data stored in RAM is lost when the power is turned off. But unfortunately it was not well known how long it takes the RAM to be completely erased by power loss. A Princeton University study was able to read security keys out of memory from computers even after a reboot. You need to have physical access to a powered computer to attack in this way, but laptops that are locked or in sleep mode are vulnerable if stolen or left unattended.

There was no mention of the implication for embedded systems, but it is obvious that cell phones and PDA security needs to be re-evaluated. The embedded space may be ahead of the curve with security technology like ARM's TrustZone already available.

Microsoft's New Portable Game Platform

Microsoft announced support for gaming on its portable music player, Zune, yesterday at GDC 08. You won't be able to start developing games for the device until the next version of Microsoft's game SDK is released in Spring 2008. With XNA Game Studio 3.0, you will be able to develop games targeted to a PC, Xbox 360, and now Zune. There has been speculation about gaming on Zune for some time because of its powerful processor and origins in the Microsoft Xbox team. A few caveats are that Zune will have a reduced API (reminds me of flash-lite), it will be some time before we see actual games released for Zune and according to a Zune team member at Microsoft, 'Zune is a wireless music and video player first and foremost.'

New Toy Touts ARM9

Leapfrog Enterprises is coming out with a new handheld gaming/learning platform called Didj. What is interesting to me is the detailed specifications they have published for the handheld. These are usually kept secret, but I think they are betting no one will come close this year for $89.99 list price.

• ARM9 at 393MHz with 32MB 131MHz DDR RAM and 256MB NAND Flash
• USB 2.0 PC connection
• 320x240 16.7 million color TFT display
• OpenGL ES 1.1 graphics API for embedded systems
• Ogg vorbis audio codec (open source royalty-free alternative to mp3)
• Theora video codec (same idea as Ogg Vorbis)
• 16 Channel MIDI software synth
• Multi-layer graphics controller
• Proprietary Leapfrog OS called Brio

Update: The Didj is using embedded Linux according to embedded software consulting firm Cozybit. The San Francisco company was contracted to port embedded Linux to the Didj and perform system integration.

Interface Connects Real Guitars to Video Games

The popularity of video games like Guitar Hero and Rock Band should create a lot of demand for systems like Ediface that interface games to musical instruments. Although the MIDI interface can do this, and has been around for years, so far it has not been used in popular games. The best possible solution would be to use an an unmodified instrument like an electric guitar and connect that to the gaming system. Learning to play a real instrument while playing video games would be a great benefit. That is what the Ediface claims to deliver in a small wallet-sized unit. No word on processor or technology being utilized to do the signal processing.

Update: A new PC/MAC game called Guitar Rising is scheduled for release in late 2008 that will use only the computer mic input for an interface to any electric guitar. Not much detail on the web site, but some early prototype demos at game conferences look promising. We will have to see how the mic input compares to a dedicated hardware interface.

Embedded Systems Conference 2008

The 2008 Embedded Systems Conference Silicon Valley is coming up April 14. Early bird registration ends Feb 18th, but you can get a free pass to the exhibits, keynotes and sponsored sessions until April 9.

Google Code Search

Google has a new search engine for public or open source software, Google /* Code Search */. It has some nice features like regular expressions, programming language filters and license-type filters. I have used cross reference sites for code searches in the past, but those are only available for a few projects. For example, the Linux Cross Reference and the FreeBSD and Linux Kernel Cross-Reference.

Check Your Math

How well do you trust the basic mathematical operations of your processor? Subtle math errors in code can allow access secure data. Even if you are not implementing a security algorithm, potential problems from basic mathematical errors can cause results that would seem impossible. There are methods to help prevent these problems:

• Use asserts before any critical operations.
• Test important (security) results for consistency.
• Use a watchdog timer.
• Check processor errata sheets (both for development and production versions).
• Use mature, well tested math libraries.
• Write unit tests for the mathematical sections of the code.

This all adds another layer of complexity to embedded system design, but that cannot be avoided with the increasing complexity and security of modern systems. So make sure to check your math.

Adding Math to List of Security Threats - NY Times Math Error Could Compromise Cryptographic Systems - Information Week