Oh crud, all my lighting runs off these things. I wish more smart controller/switches used powerline networking rather than WiFi.
But then your neighbors house can become an attack vector for your house.
ESP32/ESP8266 Wi-Fi Attacks
31–40 of 152 posts
Re: ESP32/ESP8266 Wi-Fi Attacks
#32ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…
These are really nice $5 chips with Wifi programmable with the Arduino toolset. Tons of IoT people use these to integrate various instrumentation and control into their houses or science projects. For instance, you can hook one up to a temperature sensor and a relay and control your heater. There are probably millions of these installed, hooked up to important hardware. So this makes wardriving fun again, I guess, if…
Just to give you some idea of how easy these are to use: In 20 mins with a small breadboard, a few Dupont wires, a Nodemcu ESP8266, a DHT22 with a pull up resister I've got a desk temperature sensor.
Add: https://esphome.io/
... and it talks MQTT and connects straight into Home Assistant.
Re: ESP32/ESP8266 Wi-Fi Attacks
#33ESP8266 is a low-cost Wi-Fi microchip with full TCP/IP stack and microcontroller capability produced by Shanghai-based Chinese manufacturer, Espressif Systems. ESP32 is a series of low cost, low power system on a chip microcontrollers with integrated Wi-Fi and dual-mode Bluetooth. some kind of IoT chips? can't tell what the real world impact of this is. edit: whoa, thanks for context folks! i'm surprised this wasn't…
Rain Bird uses them in their WiFi enabled Sprinkler Control Systems.
Looks like the pool on the roof might have a leak.
Re: ESP32/ESP8266 Wi-Fi Attacks
#34First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…
Vulnerabilities in Broadcom/Cypress wifi chips' firmware have been known for a while now:
Re: ESP32/ESP8266 Wi-Fi Attacks
#35Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…
Reading carefully the documents presented by the author Enterprise mode seems to be even less secure than the normal WiFi mode. Quite ironic I agree.
That's like E-TLS. The enterprise version of TLS.
Re: ESP32/ESP8266 Wi-Fi Attacks
#36Earlier quoted context omitted.
I'd say Espressif has a near monopoly due to first comer advantage. There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet. Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions…
Realtek has the RTL8710, which is a lot like the ESP8266 but with an ARM Cortex-M3 (while Espressif uses the rather obscure Xtensa architecture), which has the advantage of getting an LLVM toolchain for it, which means you can program it in Rust (while the ESPs are mostly limited to C). The real advantage of the ESP8266 however is its raw popularity. It has an Arduino environment, tons of ready to run sketches, Basic…
I heard of Realtek,and took a look at it. It still comes with fever RF accessories on package, and thus grows your BOM. And their wireless docs and SDK as a whole are kind of obscure/"Taiwan style"
Plus, since it comes from "another China" it's subject to Chinese customs duty which negates whatever cost advantage it could have.
Re: ESP32/ESP8266 Wi-Fi Attacks
#37Yeah, I've caused some of these crashes. The IDF needs a lot of work when it comes to some of the stacks. I've been trying to bring the Bluetooth stack (which shares a common ancestor with the Android one) closer to the current Android Bluetooth stack, since that's well maintained (ish) and I'm extending it.
Have you seen that the latest ESP-IDF includes Apache's NimBLE stack? I'm hoping that improves things a bit.
Re: ESP32/ESP8266 Wi-Fi Attacks
#38Earlier quoted context omitted.
Reading carefully the documents presented by the author Enterprise mode seems to be even less secure than the normal WiFi mode. Quite ironic I agree.
That's like E-TLS. The enterprise version of TLS.
It feels somewhat irresponsible to not have some scare quotes or a disclaimer or something in there. There's probably some people who are just learning about "enterprise TLS" who don't know that it's hobbled: https://www.eff.org/deeplinks/2019/02/ets-isnt-tls-and-you-s...
Re: ESP32/ESP8266 Wi-Fi Attacks
#39Earlier quoted context omitted.
I'd say Espressif has a near monopoly due to first comer advantage. There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet. Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions…
Realtek has the RTL8710, which is a lot like the ESP8266 but with an ARM Cortex-M3 (while Espressif uses the rather obscure Xtensa architecture), which has the advantage of getting an LLVM toolchain for it, which means you can program it in Rust (while the ESPs are mostly limited to C). The real advantage of the ESP8266 however is its raw popularity. It has an Arduino environment, tons of ready to run sketches, Basic…
There is now a branch of LLVM that supports XTensa. You can run Rust code on an ESP, but it’s awkward.
Re: ESP32/ESP8266 Wi-Fi Attacks
#40First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…
Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".
"avoiding patent infringement lawsuits via opacity"