Breach Brief: White House computer network hacked

The Obama Administration has revealed that hackers recently breached an unclassified computer network used by the President’s senior staff.

What happened? First reported by the New York Times, officials said the cyberattack “did not appear to be aimed at destruction of either data or hardware, or to take over other systems at the White House. That strongly suggests that the hackers’ intention was either to probe and map the unclassified White House system, find entry points where they connect to other system or conduct fairly standard espionage.”

What information was breached? According to the Washington Post, “The breach was discovered two to three weeks ago… Some staffers were asked to change their passwords. Intranet or VPN access was shut off for awhile, but the email system, apart from some minor delays, was never down.”

Who’s behind it? Sources say the attack was consistent with that of a state-sponsored effort. The Post notes that a number of security firms have identified cyber-­espionage campaigns by Russian hackers thought to be working for the government. Targets have included NATO, the Ukrainian government and U.S. defense contractors.

What they’re saying: “In the course of assessing recent threats, we identified activity of concern on the unclassified Executive Office of the President network. We took immediate measures to evaluate and mitigate the activity… Unfortunately, some of that resulted in the disruption of regular services to users. But people were on it and are dealing with it… Our computers and systems have not been damaged, though some elements of the unclassified network have been affected. The temporary outages and loss of connectivity for our users is solely the result of measures we have taken to defend our networks.”

With the number of breaches on the rise and security at our core, learn how Atmel has you covered.

Report: Cyber breaches put 18.5 million Californians’ data at risk

The recent string of major data breaches — including the likes of Target, Home Depot, P.F. Chang’s and Nieman Marcus — have spurred a 600% increase in the number of California residents’ records compromised by cyber criminals over the last year, the latest California Data Breach Report revealed.

According to the study, a total of 167 breaches were reported in 2013 – where 18.5 million personal records were compromised – an increase of 28% from 2012 where just 2.5 million records were stolen. To put things in perspective, that’s nearly half of the state’s population (38 million).

These figures experienced a large uptick following recent incidents involving Target and LivingSocial, which together accounted for 7.5 million of the breached records. Out of the incidents reported in 2013, over half (53%) of them are attributed to malware and hacking.

“Malware and hacking breaches made up 93% of all compromised records (over 17 million records). The LivingSocial and Target breaches accounted for the bulk of those records . In April, the online marketplace LivingSocial reported a cyber attack on their systems that compromised the names, email addresses, some birth dates and passwords of over 50 million customers, including 7.5 million Californians. In December, Target reported a hacking and malware insertion into its network that resulted in the theft of the names and payment card data of 41 million customers, including 7.5 million Californians,” the report noted.

Even by factoring out both Target and LivingSocial, the amount of Californian records illegally accessed last year rose 35% to 3.5 million.

“Data breaches pose a serious threat to the privacy, finances and personal security of California consumers. The fight against these kind of cyber crimes requires the use of innovative strategies by government and the private sector to protect our state’s consumers and businesses,” California Attorney General Kamala Harris said in a statement.

While California residents aren’t any more susceptible to data hijacking than others, the state law requires businesses and agencies to notify customers of any breach involving more than 500 accounts. This law led to the creation of the California Data Breach Report.

The last 12 months weren’t a fluke either. In fact, “These data breaches are going to continue and will probably get worse with the short term,” emphasized Jim Penrose, former chief of the Operational Discovery Center at the National Security Agency.

Aside from payment cards, which the Attorney General urged companies to adopter stronger encrypting and safeguard technologies, one of the most vulnerable sectors is the healthcare industry. Not only are a number of medical devices coming under siege by hackers, stolen health records are also plaguing the industry. Moreover, cyber thieves accessing unprivileged information can even be more harmful than other stolen data as it can be used for identity theft and fraud over a longer duration.

In 2012-2013, the majority of breaches in the healthcare sector (70%) were caused by lost or stolen hardware or portable media containing unencrypted data, in contrast to just 19% of such breaches in other sectors.

“By now, the problem should be obvious to anyone who is paying attention — data of any kind is vulnerable to attack by a wide variety of antagonists from hacker groups and cyber-criminals to electronic armies, techno-vandals and other unscrupulous organizations and people. The reason is simple. Yes, you guessed it: It is because data = money. To make it worse, because of the web of interconnections between people, companies, things, institutions and everything else, everyone and everything digital is exposed,” explained Bill Boldt, Atmel’s resident security expert.

To safeguard information and devices, authentication is increasingly coming paramount. As the latest incidents highlight, thinking about forgoing security in a design simply because that device isn’t connected to a network or possesses a wireless interface? Think again. The days of truly isolated systems are long gone and every design requires security. As a result, the first step in implementing a secure system is to store the system secret keys in a place that malware and bugs can’t get to them – a hardware security device like CryptoAuthentication. If a secret key is not secret, then there is no such thing as security.

Want to read more? Download the entire report here.

Infographic: 2014’s top data breaches (so far)

Dating back to last December, a string of major data breaches have affected nearly every sector, including a number of today’s most notable brands. This infographic from DataBreachToday highlights some of the most significant breaches, based on what each publicly disclosed around the incident.

Evident by the surge in cyber crime, the world has become a serious hackathon with real consequences; and, unfortunately, it is likely that it’ll only get worse with the rise of mobile communications, cloud computing, and the growth of autonomous computing devices and the Internet of Things.

So, what can be done about these growing threats against secure data? Here’s how to ensure trust in our constantly-connected world.

And, it appears that the general public is now cognizant of these threats, casting its doubts on the security of their data. With the growing number of breaches and vulnerabilities, a recent Gallup poll has revealed that Americans are more likely to worry about hackers accessing and stealing their personal information than any other crime, including burglary and murder. Specifically, 69% of these respondents claimed they frequently or occasionally fret over the notion of having their credit card information stolen by cyber criminals. These worries are justified, too. Over 25% of all Americans have experienced some form of card information theft, making it the most frequently cited crime on the infographic from Forbes below.

U.S. agencies investigate medical devices for cyber flaws

According to a recent report from Reuters, the U.S. Department of Homeland Security is currently investigating nearly two dozen cases of suspected cybersecurity vulnerabilities in medical devices and hospital equipment that officials fear could be exploited by hackers.

(Source: Getty Images)

The vulnerable products include implantable heart implants and drug infusion pumps, thus leaving members of the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) concerned these flaws could be used to induce heart attacks and drug overdoses, among other things.

Without naming companies, the ISC-CERT team announced last year that a vast assortment of these medical devices contain backdoors making them quite susceptible to potential life-threatening hacks. These hard-coded password flaws affected roughly 300 medical devices — ranging from ventilators and patient monitors to surgical and anesthesia devices — across approximately 40 vendors.

(Source: Shutterstock)

“The senior DHS official said the agency is working with manufacturers to identify and repair software coding bugs and other vulnerabilities that hackers can potentially use to expose confidential data or attack hospital equipment,” Reuters stated.

While there are still no known deaths as a result of such malicious behavior, officials claim that it certainly isn’t “out of the realm of possibilities,” comparing similar incidents to those seen on TV like the show Homeland. In this Showtime Network spy drama, a fictional U.S. vice president is killed via cyber attack on his pacemaker. Coincidentally enough, former Vice President Dick Cheney has revealed that he once feared a similar attack and to prevent such thing from happening, disabled the wireless connectivity of his pacemaker.

Reuters points out that security officers are increasing their vigilance around cyber threats and that medical facilities throughout the country have beefed up their networks to protect from intruders. Furthermore, the report notes that security vulnerabilities in medical devices are exposed so manufacturers can fix them, and that there was no need for patients to panic. Nevertheless, as one can imagine, this still leaves many uneasy.

As scenarios such as these continue to emerge, it is becoming increasingly clear that embedded system insecurity affects everyone and every company, not just those in the healthcare world. Products can be cloned, software copied, systems tampered with and spied on, and many other things that can lead to revenue loss, increased liability, and diminished brand equity… or in this case, injury or death. Worry no more! Thanks to ultra-secure defense mechanisms and security at its core, Atmel devices can protect firmware, software, and hardware products from future threats. Register for a chance to receive a free CryptoAuthentication tool kit here!

Hackerspaces: A prelude to the Maker Movement and today’s Maker culture

So, what exactly is the Maker Movement? Do you remember that ever so distant yet memorable quote by Michelangelo? “Every block of stone has a statue inside it and it is the task of the sculptor to discover it.” 

Now, to further set this, [white fuzz] the channel just switched, we are tuned. Things will change right? They have changed. We have the Internet; we will have one layer more, eventually the arrow of technology will continue. There is one congruent dataset, which manifests all things to a new exponent. It’s the pulses and signals resulting from the exterior world meshed with the existing datasets of infrastructure, enterprise, and the consumer. Let’s speak of this layer. It will be filled with sensors, microcontrollers, and code. Already, we learned this from the app revolution and we are not going to remain in just this stage right? The code will be leaner and smarter. Coupled by the signal readings from millions of device upon device, node to nodes, nodes to node, the true power of distribution and networks will again marry now with other application recorded data in a mosaic of diversified integrations resulting from the intersection of data easily bridged from the cloud apps. Yes, the ones we are already familiar today touching from screen to screen to anticipate the next arriving notification.

The arrival of this integration of data will help filter and augment the world before us. Let’s reset to the modern era, thread modern computing to this notion, [for technology’s sake] we have also seen the Gartner quote by Jim Tully stating, “By 2018, 50% of the Internet of Things solutions will be provided by startups which are less than 3 years old”.

The Digital Renaissance and the Maker Movement

Together with the accessibility and progress of open source and availability of community and embedded development boards [specifically wider use of Arduino Maker class boards], the times have certainly changed. A great deal of the complexities of these development boards are relaxed with onboard abstraction layers to loosen the programmatic rigidness of “hardware,” combined with the collective tuning of the community toward its development software.

Arduino IDE is now quite anchored into well-received feedback/contribution loops supported by the open source model — crowdsource progress and joint development roadmaps. Let’s not forget all the risky and obviously passionate Makers out there doing and bringing ideas to the forefront. The timing is right — found in the appetite to feed the market, the maturing cloud, the developed community, parity in prototyping, and the global production.

Globalization of Hackerspaces and the Maker Movement | Photo Credit: Mitch Altman

As a whole, and to its sum of its parts, all community members are participants in the evolution of the ecosystem and community effort of “Making” with ease. At all aspects of the innovation engine cycle, the open source community couples quite well with hackerspaces, where one can congregate to surface ideas and mature them to fruition.

Open Source Community and Hackerspaces | Photo Credit: Mitch Altman

This is especially true where it applies to the mere process of creating a product. In fact, it’s now true to building things that 10 years ago you needed to be in a big company to make innovating things, but now it truly possible from an individual. Made possible to said horizon, there are the hackerspaces. It’s a place that shows signs of innovation and development, infusing wider spread of technology and community across all economic classes or cultures. In these facilities, these are technical and creative social clubs facilitating activities that include tinkering, machine tooling, 3-D printing, coding, open source, collaboration, and sharing. Some hackerspaces market themselves under the more benign-sounding label of “maker space”. More bluntly, this is really drawing attention as private incubators such as hardware accelerators fueling entrepreneurship and startups [an emulation of an innovation success formula taken from the original hackerspaces.

There is something about hackerspaces that brings people together that are made of some pretty awesome stuff. Call it “Voltron” if you will, why not? With drones rising and Maker Faires (or similar) blooming all around us, it all seems like the perfect unison of having people interlock together. As the notion of building robots continued to unwind, one fellow by the name of Chris Anderson saw that it would be much easier to have robots fly first than walk bipedal. More simply, it just felt and saw it to be much easier. Perhaps, something even more achievable and widespread adopted as the next step to bring about the age of drones.

But still, wait, there’s even more to how this started. We also owe the spawning of drones to a unique origin where a group of people, hive together pursuing one ultimate quest.

Call it social science and synergy if you will. Something happens when a group gets “too large” and suddenly it all transforms from a conversation into a cacophony and a team into a mob then something incorporated too soon begins may wield the ugly cues of politics. Yet, going it alone is usually impossible if the task at hand is at all sometimes complicated [maybe the next best thing for technology]. Assembling IKEA furniture is probably best done as an individual, but things like raising a family, having a stand-up meeting, or shipping a meaningful product is definitely a team sport…

For hackerspaces, one of these unique values is in having opportunities to meet different people from all sorts of backgrounds. Combined in a common pursuit of sharing and making, there is a common thread of being willing to be giving their time and talents to others. Note, it was in what’s said as “giving” as the common notion in hackerspaces are the more you give, the more you get back, helping to change the course of things to come [individual pairing of ideas to the intellectual hackerspace benefit of networking ingenuity]. It’s all about the community. This is the hallmark of the Internet. The Internet started as a community in its deeper past with ARPANET. We are all reaping those originally rooted benefits today [first operational packet switching networks implementing TCP/IP] creating layer upon layer new industries, service models, and ecosystems (ie Apps, Cloud, M2M, IoT, etc). Now what we are seeing today sprout from city to city are hackerspaces. In fact, we may begin to see every community in a city drawing upon good reason to incubate and nest new hackerspaces. Perhaps, it’s a progenitor to something more in the next trend of innovation.

The digital life now is a result of the collision of software and hardware. Technology is fashion. Fashion is Technology. Both are now intertwined together in the speed and making of culture. Have you ever tried leaving your home without the mobile touch screen device or everyone has out grown to wearing the old flip analog/cdma phones of the past. Digital influence upon culture and self move along prevalently—the desire for hackerspaces are becoming more acquainted in many metropolitans.

There’s a secret sauce to the structure of the hackerspaces. Unravel this structure. From within, it reveals a true community based packed with peer-to-peer involvements. People with skills converge in distinct trades upon others with other skills. Combined, they make this union, transforming their once ideate policy of making, broadening their abilities coupled by a giving and sharing of others to expand the design envelope of possibilities.

Surely, one may see it as a digital and hardware renaissance, comparatively from the distant spark of the past. The foundries of artistry in Florence and Rome once prevailed, urging communities of artist to congregate and make creative expression toward emulating realism via sculpture, oil and canvas. Well, now it’s about achieving a more meaningful product. The canvas has changed, coalescing digital and hardware. Giving rise to an idea where the ideas mature into a minimal valuable product that is mapped to some form of developed connectivity. This some form of developed connectivity is what we call the Internet of Things or many of the products sprouting from emergent crowdfunding rooted by makerspaces or hackerspaces.

A common construct. Make Ideas, Make Genuis, and Make Things | Photo Credit: Mitch Altman

Now, let us imagine a place where people get together without a common construct or preconceived established code, they then converse, and collaborate. It is filled to the brim with entrepreneurs and inventors of all types working on projects that they hope will change the world or at least convinced to usher an adoption to things making what we usually do more easier or enhanced.

Many of them are on laptops or standalone computers frantically typing business plans or hacking out code; others are making phone calls while trying to set up connections wherever they can.

Hackerspaces have an environmental core that keep ideas flowing | Photo Credit: Mitch Altman

As all the chaos goes about, one can see that in this space is an environmental core that keeps the magic flowing around innovation. It is the center foundation of what the area will turn into. While the outer linings are being fine-tuned and polished, the inner workings remain relatively unchanged. The concrete has been laid; the electrical wires have been strung throughout the wooden frames and the insulation and drywall is mostly there, all while a wireless network is hangs throughout the air. Projects can begin even if the air conditioning isn’t hooked up yet.

As long as there is a good foundation, people can get stuff done. The rest of the work on the outer edges will always be changing. Paint will cover the walls in different shades and dust will always need to be cleaned up. However as time goes on and unless a major change happens, all the people running the space will need to do is adjust the dials of the environment (when needed) and continue progressing the community. Once the foundation is done first, the rest will fall into place.

Next up, read the 1:1 interview with Mitch Altman, co-founder of Noisebridge San Francisco as we dive deeper into hackerspaces, the Maker Movement and more…

 

 

Breach Brief: Staples says probing possible data breach

Staples is investigating a possible breach of payment card data, making it the latest U.S. retailer to become a victim of a cyberattack.

What happened? Security blogger Brian Krebs reported that multiple banks have identified a pattern of credit and debit card fraud suggesting that several office chain’s locations in the northeast are currently dealing with a data breach. Experts believe the cyber criminals are using a form of the same malicious software Backoff used in the Target, Home Depot and Dairy Queen attacks, among a number of others.

What information was breached? According to more than a half-dozen banks, it appears likely that thieves have succeeded in stealing customer card data from seven Staples stores in Pennsylvania, at least three in New York City, and another in New Jersey.

What they’re saying: Staples has issued a statement saying that they are “in the process of investigating a potential issue involving credit card data and have contacted law enforcement… We take the protection of customer information very seriously, and are working to resolve the situation. If Staples discovers an issue, it is important to note that customers are not responsible for any fraudulent activity on their credit cards that is reported on [in] a timely basis.” 

With the number of breaches on the rise and security at our core, learn how Atmel has you covered.

Breach Brief: Hundreds of Dropbox accounts leaked after third-party hack

A thread recently surfaced on Reddit that contained links to files containing hundreds of Dropbox usernames and passwords in plain text, while at this point, its origins remain unclear. Supposedly, hackers are threatening a major breach in Dropbox security, claiming to have stolen the log-in credentials of nearly 7 million users. If their Bitcoin ransom is paid, the cyber criminals are promising to release more password details.

How many victims? The log-in details for 400 email addresses, each one starting with the letter B, have been labeled as a “first teaser… just to get things going.” In what may appear to be part of a much larger-scale Dropbox hack, the hackers claim to have accessed details from 6,937,081 individual accounts.

What information was breached? It remains uncertain as to how the account details were accessed and of course, whether or not they are actually valid. However, the hackers are believed to be in possession of various user photos, videos and other files.

When did it happen? An entry on Pastebin was posted on October 13 at 4:10pm CDT with a link to the list of emails and matching plain text passwords.

What they’re saying: Dropbox has issued a statement on its blog emphasizing that the passwords were stolen from “unrelated services.”

Recent news articles claiming that Dropbox was hacked aren’t true. Your stuff is safe. The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the internet, including Dropbox. We have measures in place to detect suspicious login activity and we automatically reset passwords when it happens.

Attacks like these are one of the reasons why we strongly encourage users not to reuse passwords across services. For an added layer of security, we always recommend enabling two-step certification to your account.

Despite its legitimacy, this incident highlights the increasingly common way hackers are using to gain access to identity credentials, such as usernames, passwords and other personal information. With the number of breaches on the rise and security at our core, learn how Atmel has you covered.

Breach Brief: Kmart victim of month-long data breach

Kmart has became the latest retailer to announce a breach in its payment systems.

How many victims? The company did not indicate how many stores were affected or how many customer credit cards were potentially compromised but said the malware had been removed.

What information was breached? The affected systems contained payment card customer names, numbers and expiration dates. The company has no evidence that other customer personal information, such as social security numbers, PINs and email addresses, was compromised as a result of this malware infection.

When did it happen? Sears Holdings Corp. announced that it detected a data breach at its Kmart stores that began in September 2014, affecting certain customers’ credit and debit card accounts.

What they’re saying: “Our Kmart store payment data systems were infected with a form of malware that was undetectable by current anti-virus systems,” Sears Holdings said in a statement.

Kmart has apologized to the public and said it was in the process of working with federal authorities, banking partners and security firms in an ongoing investigation into the hacking. The Secret Service was among the agencies in the probe, a spokesman said. Earlier this summer, the Secret Service estimated that nearly 1,000 American merchants were affected by this kind of attack, and that many of them may not even know that they were breached.

With the number of breaches on the rise and security at our core, learn how Atmel has you covered.

Breach Brief: Dairy Queen says 395 stores hit by data breach

Dairy Queen is the latest company to get hit by a security breach, confirming that nearly 400 locations (and one Orange Julius location) were compromised by Backoff malware in August.

How many victims? The credit and debit card systems of 395 Dairy Queen locations were infected with the infamous Backoff malware that has targeted retailers around the country, Dairy Queen said in a news release.

What information was breached? The affected systems contained payment card customer names, numbers and expiration dates. The company has no evidence that other customer personal information, such as Social Security numbers, PINs or email addresses, was compromised as a result of this malware infection.

When did it happen? While the time period for each store affected varies by location, some breaches began as early as August 1, 2014 and ended as late as October 6, 2014.

With the number of breaches on the rise and security at our core, learn how Atmel has you covered.

There’s good news about BadUSB

The good news about the recently-revealed BadUSB is that there actually is a cure: Atmel CryptoAuthentication. Hardware crypto engines were invented to protect software, firmware and hardware from exactly these types of attacks, among many others. These uber-tiny, ultra secure hardware devices can be easily and cost-effectively added to USB sticks (and other peripherals) by manufacturers, who are seeking to protect their customers by ensuring that only the proper and intended code is downloaded and used. Once installed into the peripherals, CryptoAuthentication devices will block the bad code. Period.

Let’s look at what Bad USB has uncovered: It is that everything with a processor is vulnerable to attack. Most people don’t really think of a USB stick, modern thermostat, home router, fax machine, PC mouse or trackpad, a camera, iPod, microwave, and other “things” as being computers; however, they are. In fact, they all have at least one processor, memory, ways to get stuff in and out, and code (firmware) that tells the processor what to do. That last piece is where the danger lies.

As any PC or smartphone user knows, code gets updated all the time to get rid of bugs and add features. Updating code opens up a processor that was previously running good code, to code altered by people with mal-intent, i.e. malware. This is how good embedded systems go bad. We recently saw malware that allowed an ATM to spit out 40 bank notes at a time if a certain code was entered. Real nice for those who know the code!

BadUSB is Bad for More Than Just USB

All systems with processors are vulnerable to bad code, which can do bad things to good systems. All it takes is a way to transfer bad code from one processor to another… and, that happens all the time. USB sticks, USB accessories, the Internet, wireless links like Wi-Fi or Bluetooth — you name it — can be vectors for diseased code. What BadUSB has revealed to us is that all embedded systems, unless equipped with robust protection mechanisms, are now vulnerable to catching diseased code. (Embola?)

Embola

One contracted, a machine infected with Embola can send private and sensitive information to bad guys, or let them take over your system for ransom or other mal-purposes. They can turn on cameras and microphones to spy, grab your photos and bank account information, or even mess with your car. Whatever they want they can have, and you most likely will never know it.

By now you should see the point, which is that every embedded system and PC needs protection. Everything that runs software is vulnerable such as wearables, phones, USB accessories, USB sticks, cameras, cars, printers, thermostats, ATMs, meters, microwaves, appliances, and whatever the IoT will become. Simply put: If it has a processor and connects to something else, it is hackable.

So, what can you do to protect against Embola? The answer is twofold:

1. Don’t let the bad code in, and
2. If it does get in, don’t let it run.

While this sounds pedantically simplistic, these steps are NOT being taken. These two functions have the self-explanatory names of secure download and secure boot.

Secure Download

Secure download uses encryption to ensure that the code that is received by the embedded system is kept away from hackers. The code is encrypted using an algorithm such as Advanced Encryption Standard (AES) by using an encryption key. That encryption key is created using a secret that is only shared with the target system. The encrypted code is sent to the target embedded system to be decrypted and loaded for its use. Along with the encrypted code, a seed is also sent to the target system.

The seed is a number (typically unique with each session) that is hashed during the encryption session with a secure secret key. The result of that hashing is called the digest or Message Authentication Code (MAC) and it is used to encrypt the code (i.e. the MAC is the actual encryption key). The seed is sent to the target system to enable decryption, and not useful to anyone unless it is hashed with the secret key, which is what the target system will do. The target system runs the same hashing algorithm with the identical shared secret key stored there and the seed, which results in the same digest (MAC) that was used to encrypt the code. That MAC can now be used as the decryption key to decrypt the code. At this point, the decrypted code can be ran in the target embedded system.

However, there is another step that can be taken that adds even more security, which is authentication using a digital signature. To use authentication, the unencrypted original code is hashed and signed by the code originator at the same time as the original encryption process. The originator uses a signing key on that hash of the code to make a signature. That signature is sent with the encrypted code and seed to the target system. Once the encrypted code is decrypted using the process noted above, the newly decrypted code will be hashed by the target system, just like was done by the originator, and then signed with the signing key stored in the target system. That signing key is the same as on the originator’s signing module, so if the decrypted code has not been altered, the signature made on the digest of that decrypted code and the signing key will be exactly the same as the signature that was sent over. These two signatures are compared and if they match then the code has been authenticated and can be safely run on the target system. What does this mean? No risk of Embola!

The two levels or security provided by secure down load with authentication is obviously very robust. It will ensure that code that was received has been kept secret during transmission and has not been tampered.

Secure Boot

Secure boot also uses digital signatures to ensure that the code to be booted when the target system starts up matches the code that the manufacturer intended and has not been tampered with. It sort of works in a similar way as secure download. If the code to be booted has been altered, then the signature made by hashing the digest of that code with a secret signing key will not match the signature from the manufacturer. If they don’t match, the code will not load.

These methods are easy and inexpensive to implement and already exist. You should be able to see by now how Atmel has you covered. Ready, set, get secure!