Agent WranglersIOT-25Recommended
Lock debug ports before the device ships
Disable JTAG and SWD with fuses on every production unit, or require a per-device unlock key. A serial console gives no shell without authentication.
How to do it
Anyone who opens the case can attach a debugger to an unlocked chip and read its flash or keys. Blow the debug fuses as the last factory step, after the factory test. If returned units need debugging, unlock each one with a signed challenge from your own service, never with a code shared across units. Keep the case closed over test pads, so reaching them takes tools. The keys this protects are those from keep each device's private key in secure hardware. ETSI EN 303 645 provisions 5.6-4A and 5.6-4B cover debug interfaces.
How to check
The end-of-line test tries to attach a debugger and to open a shell on the serial console of every unit. Both fail, and the fuse state is stored with the unit's serial number.
Sources
Related rules
- IOT-2 Keep each device's private key in secure hardware in Connected devices
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/local-network-exposure/debug-ports-locked">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.