Security Notes

Analyses on product security.

Technical analyses, practical engineering insights and regulatory context for teams developing security-critical products.

Redlings’ own investigations and research findings are published under Research.

Engineering Note Featured Mar 12, 2026 8 min read

Secure Boot: What Signature Verification Protects, and What It Doesn’t

Secure boot is treated as a checkbox: enabled, done. But a valid signature only proves where an image came from. Currency, configuration and chain completeness, the properties real products actually fail on, are separate mechanisms.

FirmwareSecure BootTesting
Read note →
All Engineering Current Field Notes
Current Note Aug 27, 2026 7 min read

CRA Vulnerability Reporting: The Technical Reality of the 24-Hour Window

From 11 September 2026, actively exploited vulnerabilities must be reported under the CRA: early warning in 24 hours, notification in 72. The legal side is documented, this is the engineering side: what the window demands from triage, SBOMs and telemetry.

RegulationVulnerability
Current Note Aug 13, 2026 6 min read

EN 18031 and the CRA: What Security Testing Can Show, and What It Can’t

EN 18031 is harmonized under the RED, not the CRA. No CRA harmonized standard exists yet. What testing against EN 18031 actually establishes, how evidence maps to CRA Annex I, and why declarations and pentest findings are not interchangeable.

RegulationTesting
Engineering Note Jul 23, 2026 8 min read

“Does This CVE Affect Our Product?”. A Practical Triage Workflow

Version matching lies, presence is not reachability, and CVSS describes the component, not your product. The four-stage chain from advisory to a defensible affected/not-affected statement, and the routine that makes it repeatable.

FirmwareRegulationVulnerability
Field Note Jul 9, 2026 5 min read

Field Note: “The Key Is in a Secure Element”. What We Check Next

The most common claim in hardware assessments is true in one narrow sense and silent about everything that matters. The four checks that follow it: debug surfaces, key policy, provisioning history, and what the key actually protects.

CryptographyDevice Identity
Engineering Note Jun 25, 2026 7 min read

Embedded Device Penetration Testing: Why a Web Pentest Isn’t Enough

A web pentest covers the API and the app, the two layers with HTTP in them. A connected product is attacked through flash chips, radio links and firmware. What a product assessment covers, layer by layer, and how to prepare for one.

FirmwareTestingWireless
Engineering Note Jun 11, 2026 7 min read

Firmware Extraction: Why Readable Flash Changes Your Threat Model

Readable flash can expose firmware and credentials. What a dump reveals depends on storage and protection; its impact depends on the recovered secrets and their permissions. How to assess effort and bound the compromise.

FirmwareTesting
Engineering Note May 28, 2026 7 min read

Device Identity: Why Shared Credentials Put the Fleet at Risk

A leaked shared key can put the fleet at risk. Unique device credentials limit the damage only when authorization, provisioning, revocation and key protection work together. What that architecture needs.

CryptographyDevice Identity
Engineering Note May 14, 2026 8 min read

BLE Pairing Security: Encryption Doesn’t Tell You Who You’re Talking To

"The link is encrypted" answers the smaller question. The bigger one: encrypted with whom? The four BLE pairing methods compared, what each assumes about trust, what legacy pairing gives away, and the mistakes we find in wireless assessments.

CryptographyWireless
Engineering Note Apr 30, 2026 8 min read

Secure Element vs. Secure Storage vs. TPM: Where Device Keys Belong

A secure element protects a secret, secure storage protects data at rest, a TPM adds the protocols to prove system state. What each option really buys, where each fails, and the two questions that decide your design.

CryptographyDevice IdentityTesting
Engineering Note Apr 16, 2026 8 min read

Firmware Anti-Rollback: Why Signed Firmware Can Still Be Downgraded

A valid signature does not enforce a minimum security level. How independent security counters block vulnerable releases while allowing defined fallbacks, and why counter storage and update confirmation matter.

FirmwareSecure BootVulnerability
Engineering Note Mar 26, 2026 7 min read

Secure Boot vs. Firmware Signing vs. Code Signing: The Differences Explained

Three controls, three places in your system, three different questions. Code signing proves your pipeline, firmware signing proves your update, secure boot enforces on the device. What each contributes, and why you need all three.

CryptographyFirmwareSecure Boot