Security Notes

Analyses on product security.

Technical analyses, practical engineering insights and regulatory context for teams developing security-critical products.

Redlings’ own investigations and research findings are published under Research.

All Engineering Current Field Notes
Engineering Note Jul 23, 2026 8 min read

“Does This CVE Affect Our Product?”. A Practical Triage Workflow

Version matching lies, presence is not reachability, and CVSS describes the component, not your product. The four-stage chain from advisory to a defensible affected/not-affected statement, and the routine that makes it repeatable.

FirmwareRegulationVulnerability
Engineering Note Jun 25, 2026 7 min read

Embedded Device Penetration Testing: Why a Web Pentest Isn’t Enough

A web pentest covers the API and the app, the two layers with HTTP in them. A connected product is attacked through flash chips, radio links and firmware. What a product assessment covers, layer by layer, and how to prepare for one.

FirmwareTestingWireless
Engineering Note Jun 11, 2026 7 min read

Firmware Extraction: Why Readable Flash Changes Your Threat Model

Readable flash can expose firmware and credentials. What a dump reveals depends on storage and protection; its impact depends on the recovered secrets and their permissions. How to assess effort and bound the compromise.

FirmwareTesting
Engineering Note May 28, 2026 7 min read

Device Identity: Why Shared Credentials Put the Fleet at Risk

A leaked shared key can put the fleet at risk. Unique device credentials limit the damage only when authorization, provisioning, revocation and key protection work together. What that architecture needs.

CryptographyDevice Identity
Engineering Note May 14, 2026 8 min read

BLE Pairing Security: Encryption Doesn’t Tell You Who You’re Talking To

"The link is encrypted" answers the smaller question. The bigger one: encrypted with whom? The four BLE pairing methods compared, what each assumes about trust, what legacy pairing gives away, and the mistakes we find in wireless assessments.

CryptographyWireless
Engineering Note Apr 30, 2026 8 min read

Secure Element vs. Secure Storage vs. TPM: Where Device Keys Belong

A secure element protects a secret, secure storage protects data at rest, a TPM adds the protocols to prove system state. What each option really buys, where each fails, and the two questions that decide your design.

CryptographyDevice IdentityTesting
Engineering Note Apr 16, 2026 8 min read

Firmware Anti-Rollback: Why Signed Firmware Can Still Be Downgraded

A valid signature does not enforce a minimum security level. How independent security counters block vulnerable releases while allowing defined fallbacks, and why counter storage and update confirmation matter.

FirmwareSecure BootVulnerability
Engineering Note Mar 26, 2026 7 min read

Secure Boot vs. Firmware Signing vs. Code Signing: The Differences Explained

Three controls, three places in your system, three different questions. Code signing proves your pipeline, firmware signing proves your update, secure boot enforces on the device. What each contributes, and why you need all three.

CryptographyFirmwareSecure Boot
Engineering Note Mar 12, 2026 8 min read

Secure Boot: What Signature Verification Protects, and What It Doesn’t

Secure boot is treated as a checkbox: enabled, done. But a valid signature only proves where an image came from. Currency, configuration and chain completeness, the properties real products actually fail on, are separate mechanisms.

FirmwareSecure BootTesting