ESP32/ESP8266 Wi-Fi Attacks

#1

Post by gioscarab » Tue, Sep 03, 2019, 3:49 PM UTC

Re: ESP32/ESP8266 Wi-Fi Attacks

#2

Post by keymone » Tue, Sep 03, 2019, 4:09 PM UTC

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems.

ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth.

some kind of IoT chips? can't tell what the real world impact of this is.

edit: whoa, thanks for context folks! i'm surprised this wasn't obvious from wiki pages.

Re: ESP32/ESP8266 Wi-Fi Attacks

#3

Post by acidburnNSA » Tue, Sep 03, 2019, 4:09 PM UTC

This appears to be the relevant thread on the Arduino ESP8266 page: https://github.com/esp8266/Arduino/issues/6016

Looks like it was closed due to "lack of info". I wonder if that caused some bad blood?

Re: ESP32/ESP8266 Wi-Fi Attacks

#4

Post by ModsCtrlideas » Tue, Sep 03, 2019, 4:10 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

They are used everywhere in IOT.

Re: ESP32/ESP8266 Wi-Fi Attacks

#5

Post by slenk » Tue, Sep 03, 2019, 4:11 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

I have some sort of Espessif wifi controller in a smart bulb.

Re: ESP32/ESP8266 Wi-Fi Attacks

#6

Post by acidburnNSA » Tue, Sep 03, 2019, 4:11 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

These are really nice $5 chips with Wifi programmable with the Arduino toolset. Tons of IoT people use these to integrate various instrumentation and control into their houses or science projects. For instance, you can hook one up to a temperature sensor and a relay and control your heater. There are probably millions of these installed, hooked up to important hardware. So this makes wardriving fun again, I guess, if not destructive.

Re: ESP32/ESP8266 Wi-Fi Attacks

#7

Post by darkwater » Tue, Sep 03, 2019, 4:12 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

AFAIK they are largely used in home-automation systems, especially home-made ones due to their low price, good enough specs and availability on resellers like AliExpress

Re: ESP32/ESP8266 Wi-Fi Attacks

#8

Post by eranation » Tue, Sep 03, 2019, 4:12 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

Anything. From things like nanny cams in a teddy bear that can be remotely hacked. (although more likely that they just had an easy to guess password if they had one at all or other more common vulnerabilities) to smart traffic lights. p.s. regarding the nanny cams: I wish I was making this up: https://www.forbes.com/sites/thomasbrewster/2018/02/21/50000...

Re: ESP32/ESP8266 Wi-Fi Attacks

#9

Post by nicoburns » Tue, Sep 03, 2019, 4:13 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

The single most popular IoT chips / network connected microcontrollers (at least among hobbyists).

Re: ESP32/ESP8266 Wi-Fi Attacks

#10

Post by Etheryte » Tue, Sep 03, 2019, 4:14 PM UTC

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories.

These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi", "IoT wifi module", and many, many more as they're the downright easiest way to add wifi to something that doesn't have it out of the box.

I'm not sure how applicable these attack vectors are in the real world, but they affect a very large number of devices for sure.