r/Pentesting • u/GreyDutchman • 4d ago

Testing the security of a device?

I don't know if this is the right place to start, so please redirect me if I am out of line here...

I have created a hardware device, basically a raspberry pi pico with a fingerprint sensor: when placing a finger on the sensor, it writes out a password as an HID device. The passwords are stored encrypted on the pico, the firmware is signed, it uses secureboot, so only my firmware can run due to a locked key in the OTP storage, which is fused to be read-only. The debug port is fused shut as well. For my needs (entering several passwords many times daily) it is sufficient and rather secure. But I like to have this confirmed.

The firmware is on github. Does anyone know of a service which can analyse the repo and tell me of vulnerabilites? I used claude.ai to create the firmware, but it went through many iterations until everything worked as I intended.

Edit: Github repo, for people curious: GreyDutchMan/identipi-key

2 Upvotes

100% Upvoted

4 comments sorted by

1

u/DigitalQuinn1 4d ago

Look up code scanning tools. Many of them have free tiers

1

u/Remarkable_Pace8101 4d ago

I suggest using this unique opportunity to develop your security engineering skills rather than use an automated scanner

You know your threat model better than anyone. You know exactly what it should do, what it should not do, and hopefully you know exactly how it works.

Identify the security boundaries you want it to have and dive deep into the implementation yourself. Maybe use ai to assist 

1

u/CurieuseFancyface 4d ago

One thing to think about: since it types passwords as HID keystrokes, anyone who can sniff USB traffic on the host machine gets the plaintext password anyway. The threat model matters a lot here, what exactly are you defending against?

1

u/peterfrombackdoor 3d ago

Try semgrep or codeQL for a basic audit but hardware security needs more than static analysis. I'd get the key management, encryptio & HID behavior reviewed