As number of the IoT (Internet of Things) devices continues to increase it becomes crucial to provide scalable and secure update mechanism. In this paper we present our improvements of the Amazon over-the-air (OTA) update process specifically targeting existing IoT devices. We want to cover broad range of device retrofitting them and making them more secure. Keeping this in mind we keep hardware requirements to minimum. We present our improvements over default Amazon OTA Agent library implementation as well as our reference implementation on STMicroelectronics B-L475E-IOT01A board. We also discuss limits of our selected approach and potential attacks not covered by it.

This work was partially supported by the Eurostars-2 joint programme with co-funding from the European Union Horizon 2020 research and innovation programme under the grant agreement E11897 RESCURE "Retrofit Security for Critical infrastructures". Furthermore, this work was also partially supported by the Austrian Ministry for Transport, Innovation and Technology under the framework of "IKT der Zukunft" with the FFG grant agreement project 865233.