A network is only as strong as its weakest device, and the instrument on the bench is often it: plugged into the lab network, running software its maker stopped updating years ago. Known holes in old software are found by automated tools, AI ones included, without anyone having to pick your lab. This page says how NovaOS is secured, how we handle what we find in the makers' own firmware, and what to do in the meantime.
CH1Our disclosure policy
Bringing NovaOS to an instrument means looking closely at the software it ships with, and sometimes that turns up a way the instrument can be reached or misused. When it does:
The maker hears first, privately. We report what we found to the instrument's maker, with the firmware version it is in, before we say anything in public.
The maker gets time to respond. We publish about 90 days after our report, or sooner once the maker has shipped a fix. What we publish then says what was found, which versions it affects, and what the maker said or fixed.
No attack recipes. We never publish passwords, keys or step-by-step attacks, before or after.
Where things stand now: we found several ways the stock firmware of the Rigol DHO800, DHO900 and MHO900 is exposed on a network, and we are reporting them to Rigol first; the details will be published once Rigol has had time to respond. Findings on other makers' instruments follow the same policy.
Found a security problem in NovaOS itself? Please tell us privately at [email protected] rather than in a public thread, and we will do for you what we ask of the makers.
CH2Until then: your instrument on your network
The Rigol scopes NovaOS runs on ship Android 7.1, a 2016 release, on Linux 4.4, which kernel.org stopped updating in February 2022. Until an instrument runs maintained software:
Keep it off networks you do not trust, or behind a firewall that lets nothing reach it from outside.
If it must be on the network, give it a segment of its own, away from the computers and devices that matter.
Plug it in when you need remote control or file transfer, and unplug it when you do not.
Nor is it only test equipment. Audit every device on your network: find out what it runs, what it listens on and when it was last updated, and update or remove what fails.
CH3How NovaOS is secured
On the Rigol scopes, where NovaOS runs today:
Maintained software. Linux 6.12, supported by kernel.org until December 2028, and updates signed by us that roll back if they fail. The calibration partition is mounted read-only.
No debug port on the network.
SSH off by default. It stays off unless you turn it on, and then it takes keys only, yours. Our bench builds carry keys of ours for testing; the build customers get carries none, and the release gate refuses to publish one that does.
No default passwords. The web pages use HTTPS and a password set on each unit. FTP takes logins only while you switch it on, with that password, and only to the user storage.
Nothing sent unless you turn it on. Every field and when it is sent is on what NovaOS sends.
The Owon and Siglent instruments get the same as NovaOS reaches them.