Agent WranglersIOT-11Recommended
Refuse firmware older than the installed security version
Each signed manifest carries a security version number. The device stores the highest number it has accepted in a counter that only goes up, and refuses any image with a lower number.
How to do it
An old firmware image is still validly signed. An attacker who installs it brings back every hole you have fixed since. Keep the counter in one-time programmable fuses or a secure element, so a flash rewrite cannot reset it. Raise the security version only for releases that fix a vulnerability. Raise the stored counter only after the new slot is marked good, so the automatic fallback still works. Compare versions as refuse updates older than the installed version shows. The SUIT information model calls this a monotonic sequence number.
How to check
In a lab test, the device is offered a validly signed image with a lower security version. It refuses it and logs the refusal. After a full flash rewrite, the stored counter keeps its value.
Sources
Related rules
- IOT-10 Keep the old firmware until the new one proves it works in Connected devices
- DSK-7 Refuse updates older than the installed version in Desktop apps, extensions and CLIs
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/firmware-updates/anti-rollback">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.