VDOO has released its Embedded Runtime Agent (ERA), a connected device security agent that analyzes device firmware binaries for security vulnerabilities. The VDOO agent pairs with the company’s Vision Analysis Platform to provide ongoing scanning of device binaries with minimal impact on system performance or functionality.

The VDOO Vision Analysis Platform is a web-based service that performs automatic analysis of device firmware, using industry standards like the Common Vulnerability Scoring System (CVSSv3) to detect known and unknown vulnerabilities. The ERA agent extends these capabilities to the device itself, providing a range of post-deployment protection mechanisms and enables users to implement “detect” or “block operation” modes.

VDOO ERA prevents:

• Exploitation of zero-day vulnerabilities to execute unauthorized code on the device
• Malicious modification, theft, and ransoming of user data, device configuration, and binaries
• Lateral movement into the device’s network for attacks on users, other devices, and network components
• Bricking of the device’s hardware and software
• Abuse of the device resources to perform massive DDoS attacks as part of a botnet, mine Blockchain, or crack passwords hashes
• Man-in-the-Middle network-based attacks throughout the device protocol stack
• Reverse engineering of the device security mechanisms and IP

In addition to runtime protection against zero-days, malware, and known attack methods, VDOO ERA can also communicate with network security solutions like security information and event management (SIEM) software, firewalls, and network access control (NAC) programs to enhance IoT network security.

“While the VDOO analysis solution, Vision, provides the ultimate tools to properly implement security building blocks and mitigate threats on connected devices, attack methods always evolve and one must have evolving countermeasures that can deal with the unknown,” said Netanel Davidi, co-founder and co-CEO at VDOO. “For that we offer ERA, the first and only runtime security solution for IoT that takes in account each devices’ specific attributes and threat landscape.”

Once a device has been analyzed, the VDOO platform provides detailed remediation guidance on how to properly implement security features. Once implemented, the platform validates the device’s security and provides a digital certification.

VDOO offers a Certified Security Engineer (VCSE) Program to help engineers learn how security should be integrated into IoT device development. These formal, hands-on training sessions are designed to provide attendees with insight into security threats, implementation and testing methodologies, and the fundamentals of designing secure IoT devices.

More information on ERA, the Vision Analysis Platform, and VCSE program can be found at www.vdoo.com.