Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ESP32/ESP8266 Wi-Fi Attacks

github.com

Post reply on HN
Print view View original

11–20 of 152 posts

Re: ESP32/ESP8266 Wi-Fi Attacks

#11

Post by gioscarab »

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

It is a WiFi enabled microcontroller locally designed and produced in china with a "100 million units sold" target. It is widely used by the makers community and by many new "smart" products. I would say that this has a really large scale impact and a lot of people will need to update the firmware.

Re: ESP32/ESP8266 Wi-Fi Attacks

#12

Post by microcolonel »

Yeah, I've caused some of these crashes. The IDF needs a lot of work when it comes to some of the stacks.

I've been trying to bring the Bluetooth stack (which shares a common ancestor with the Android one) closer to the current Android Bluetooth stack, since that's well maintained (ish) and I'm extending it.

Re: ESP32/ESP8266 Wi-Fi Attacks

#13

Post by Klathmon »

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much.

I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in high security environments or "enterprise" areas? and is the ability to gain control over a device on those networks a big deal?

Enterprise WPA2 always seemed crazy complex, and the fact that many devices can't even seem to do WPA2 Personal completely correctly, I never had a good feeling about the Enterprise stuff.

Re: ESP32/ESP8266 Wi-Fi Attacks

#14

Post by fra »

First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there.

That being said, the status quo is completely untenable. Connectivity has become the norm in the hardware space, and it is built on a shoddy software foundation. Vendor SDKs are often best effort endeavors provided "as is" with no thought given to security or reliability. The results are clear: "the S in IOT stands for security" has become a trope, and connected cameras, locks, washing machines, and many more are getting owned on a weekly basis.

This will change, and whoever cracks this nut will be very successful indeed.

Re: ESP32/ESP8266 Wi-Fi Attacks

#15

Post by Klathmon »

Etheryte wrote: post #10

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories. These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi",…

They are also really capable processors on their own with some nice I/O, and they can be integrated to be really low power so things can run on battery power for months to years.

Re: ESP32/ESP8266 Wi-Fi Attacks

#16

Post by gioscarab »

Klathmon wrote: post #13

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…

Reading carefully the documents presented by the author Enterprise mode seems to be even less secure than the normal WiFi mode. Quite ironic I agree.

Re: ESP32/ESP8266 Wi-Fi Attacks

#17

Post by penagwin »

Klathmon wrote: post #13

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…

I don't have any experience with Enterprise Wifi, but according to the article:

> This practically means that unpatched ESP devices are more secure by actually using just WPA2 Personal.

This is good for all of us DIY'ers that are only using Personal WPA2 - the worst we're exposed to is targeted DOS attacks.

Re: ESP32/ESP8266 Wi-Fi Attacks

#19

Post by cptskippy »

Klathmon wrote: post #13

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…

> I'm not familiar with the Enterprise WPA2 stuff.

WPA2 Enterprise doesn't use a preshared key, instead relying on something like RADIUS Authentication to validate usernames/passwords and then providing a custom key.

If you uses your Active Directory credentials to login to corporate WiFi then you're using WPA2 Enterprise.

Re: ESP32/ESP8266 Wi-Fi Attacks

#20

Post by gioscarab »

fra wrote: post #14

First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…

Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".
Post reply on HN