Skip to content

iot_firmware_lead_scoring.md

Latest commit

 

History

History
92 lines (71 loc) · 2.78 KB

iot_firmware_lead_scoring.md

File metadata and controls

92 lines (71 loc) · 2.78 KB
Raw

IoT Firmware Lead Scoring Template

Use this to rank leads by evidence quality, reachability, impact, and proof cost.

First write each lead as an input-to-sink graph. Score the lead only after you can name the entry point, controlled value, dangerous operation, and missing proof. Use the research algorithms when deciding which component or experiment should come next.

Evidence state:

lead                 = artifact with a missing evidence edge
hypothesis           = named input/sink/decision plus a test
confirmed root cause = code/config/metadata explains the failure
demonstrated impact  = safe proof shows the security effect

Scoring:

0 = absent
1 = weak / inferred
2 = concrete evidence
3 = proven
Lead ID State Description Source type Reachability Input control Dangerous sink / weakness Root cause clarity Dynamic proof Impact Total Decision
L1 lead static / S115 / S130 / L10 / CVE / manual
L2 lead static / S115 / S130 / L10 / CVE / manual
L3 lead static / S115 / S130 / L10 / CVE / manual

Decision rules:

18+  -> primary finding candidate
14-17 -> secondary candidate
9-13 -> investigate only if quick
0-8  -> reject or park

Hard gates:

  • If reachability is 0, do not make it the primary finding.
  • If input control is 0, do not claim exploitability.
  • If root cause clarity is 0, keep investigating before reporting.
  • If dynamic proof is 0, you may still report only if static reachability and root cause are strong and limitations are explicit.

Effort And Escalation

For the top two or three leads, estimate the work needed to close the next missing edge. This prevents a high-impact but hardware-blocked hypothesis from consuming the case.

Lead ID Missing edge Cheapest confirming test Estimated effort Hardware required? Reusable result? Continue?

Use this rule:

continue when the next test is bounded and can materially improve reachability,
root cause, impact, or confidence; otherwise park the lead with a revisit condition

Assumptions And False Positives

Lead ID Assumption False-positive risk Evidence that would reduce risk Abandon condition

Lead Detail

Lead ID

  • Evidence:
  • Source type:
  • Evidence state:
  • Exact files/functions:
  • Route/service:
  • Controlled input:
  • Sink/weakness:
  • Reproducer idea:
  • Missing proof:
  • Cheapest next experiment:
  • Abandon condition:
  • Assumptions / false-positive risk:
  • Next command:
  • Decision: