ESP32/ESP8266 Wi-Fi Attacks • Hacker News Board

Re: ESP32/ESP8266 Wi-Fi Attacks

#21

Post by stefan_ » Tue, Sep 03, 2019, 4:26 PM UTC

fra wrote: post #14

First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…

Uhh, their WiFi implementation is hacked-together old open source code distributed as statically linked binary blobs. And that is just the software part, there isn't much visibility into the silicon side..

Re: ESP32/ESP8266 Wi-Fi Attacks

#22

Post by cptskippy » Tue, Sep 03, 2019, 4:26 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

Rain Bird uses them in their WiFi enabled Sprinkler Control Systems.

Re: ESP32/ESP8266 Wi-Fi Attacks

#23

Post by baybal2 » Tue, Sep 03, 2019, 4:30 PM UTC

Etheryte wrote: post #10

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories. These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi",…

I'd say Espressif has a near monopoly due to first comer advantage.

There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet.

Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions never went beyond the tech demo stage.

Re: ESP32/ESP8266 Wi-Fi Attacks

#24

Post by amiga-workbench » Tue, Sep 03, 2019, 4:31 PM UTC

Oh crud, all my lighting runs off these things. I wish more smart controller/switches used powerline networking rather than WiFi.

Re: ESP32/ESP8266 Wi-Fi Attacks

#25

Post by mpettitt » Tue, Sep 03, 2019, 4:31 PM UTC

The fake beacon frame issue is the key one here - relatively few people are using Enterprise WPA2, but ESP8266 (or compatible - such as the Tuya TYWE3S) chips are in all kinds of random low cost IoT devices. I've got some smart plugs which use them, as well as a few of the dev boards connected up to various sensors, so looks like will have some patching to do...

Re: ESP32/ESP8266 Wi-Fi Attacks

#26

Post by baybal2 » Tue, Sep 03, 2019, 4:32 PM UTC

keymone wrote: post #2

ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…

> some kind of IoT chips? can't tell what the real world impact of this is.

This is what virtually every WiFi toaster around uses now. If you see a wifi device below $20, it is almost certain that it will be Esp32 inside

Re: ESP32/ESP8266 Wi-Fi Attacks

#27

Post by djsumdog » Tue, Sep 03, 2019, 4:38 PM UTC

So is there any way to mitigate these vulnerabilities, or does it require replacing the hardware?

Re: ESP32/ESP8266 Wi-Fi Attacks

#28

Post by solarkraft » Tue, Sep 03, 2019, 4:44 PM UTC

baybal2 wrote: post #23

Etheryte wrote: post #10

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories. These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi",…

I'd say Espressif has a near monopoly due to first comer advantage. There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet. Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions…

Realtek has the RTL8710, which is a lot like the ESP8266 but with an ARM Cortex-M3 (while Espressif uses the rather obscure Xtensa architecture), which has the advantage of getting an LLVM toolchain for it, which means you can program it in Rust (while the ESPs are mostly limited to C).

The real advantage of the ESP8266 however is its raw popularity. It has an Arduino environment, tons of ready to run sketches, Basic, Javascript, Lua and Python interpreter environments and lots of interesting projects already done with it.

The ESP32 follows right in its foot steps with even more features, power and power saving features. Espressif really saw the market the DIY community means and did some minor tweaks to its policies to cater to it, which probably helped its popularity with commercial hardware makers as well.

Re: ESP32/ESP8266 Wi-Fi Attacks

#29

Post by mendesgeo » Tue, Sep 03, 2019, 4:45 PM UTC

cptskippy wrote: post #19

Klathmon wrote: post #13

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…

> I'm not familiar with the Enterprise WPA2 stuff. WPA2 Enterprise doesn't use a preshared key, instead relying on something like RADIUS Authentication to validate usernames/passwords and then providing a custom key. If you uses your Active Directory credentials to login to corporate WiFi then you're using WPA2 Enterprise.

yes, what was discovered is that no matter what master key was exchanged after the radius authentication, the attacker can still hijack the device.

Re: ESP32/ESP8266 Wi-Fi Attacks

#30

Post by mendesgeo » Tue, Sep 03, 2019, 4:47 PM UTC

djsumdog wrote: post #27

So is there any way to mitigate these vulnerabilities, or does it require replacing the hardware?

The silicon vendor Espressif has already patched the last firmware (SDK) of such devices. However, other products that uses this chips with still have to patch against it.