OWASP Embedded Application Security
- Prevent the use of dangerous functions and APIs in efforts to protect against memory-corruption vulnerabilities inside firmware. (e.g. Use of unsafe C functions - strcat, strcpy, sprintf, scanf) 
- Ensure secure compiler flags or switches are utilized upon each firmware build. (e.g. For GCC -fPIE, -fstack-protector-all, -Wl,-z,noexecstack, -Wl,-z,noexecheap etc..)
- Ensure robust update mechanisms utilize cryptographically signed firmware images for updating functions.
- Do not hard code secrets such as passwords, usernames, tokens, private keys or similar variants into firmware images.
- Dispose and securely wipe sensitive information stored in buffers or temporary files during runtime after they are no longer needed (e.g. Wipe buffers from locations where personal identifiable information is stored before releasing the buffers)
- Modify Busybox and embedded frameworks alike to only libraries and functions that are being used. (e.g.. Remove unused languages like perl and services such as Telnet, FTP etc)
- Validate all debugging and pre-production code have been removed prior to firmware deployment.This includes potential "backdoors code" and accounts left behind by ODM's code base. 
- Ensure all methods of communication are utilizing industry standard encryption configurations for TLS.
- Limit collection, storage, and sharing of personal identifiable information (PII) to items that are only required for operation.
- Ensure the kernel, software packages and third party libraries utilized in embedded images are updated to prevent from known publicly available exploits. (e.g. Rompager  UPnP 
This list was created based upon community feedback discussed here 
- Angr - 
- Firmadyne 
- Firmwalker 
- Binary Analysis 
- Flaw Finder 
- IDA Pro (supports ARM / MIPS)
- Radare2 
- Binwalk 
- Firmware-mod-toolkit 
- Capstone framework 
- Shikra 
- JTagulator 
- UART cables
- JTAG Adapters (JLINK)
- CPLDs (in lieu of FPGAs)
- Multimeter (Ammeter, Voltmeter, etc)
- Logic Analyzers for SPI 
- GreatFET 
- Curate a list of embedded secure coding best practices.
- Create a Top 10 Embedded Application Security list.
- Participate in PR-related activities to involve the embedded community at large.
Feel free to join the mailing list and contact the Project leader if you feel you can contribute.