mirror of
https://github.com/e-m-b-a/emba.git
synced 2026-10-12 02:13:21 +00:00
Michael Messner
77b8bf6e39
Removed mention of read-only filesystem and added new contact methods for reporting vulnerabilities.
1.7 KiB
1.7 KiB
Security Policy
EMBA is a platform for optimizing our research and testing tasks in the field of IoT, OT, ICS and general embedded analysis. Because of this, we include code quite early and sometimes in a very raw state. We do not recommend setting up EMBA as a productive environment or in an unprotected environment! If you are using EMBA you should know what you are doing.
WARNING
EMBA is using multiple protection layers like chroot, docker, non executable mounts and disabled networking functionality. Nevertheless, EMBA should only be used on test systems! It should not be installed/deployed on production systems.
There are multiple reasons for that:
- The EMBA docker container is running in privileged mode which will result in full system compromise if you are testing malicious firmware.
- EMBA automatically executes untrusted code from the firmware which could lead to breakouts that are able to compromise the host system.
- EMBA automatically builds and boots a firmware image based on the untrusted firmware under test.
- EMBA is heavily based on a lot of different components that are sometimes outdated and not well maintained anymore.
Reporting a Vulnerability
If there is a security problem within EMBA please open an issue or contact us via one of the following ways: