Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ESP32/ESP8266 Wi-Fi Attacks

github.com

Post reply on HN
Print view View original

41–50 of 152 posts

Re: ESP32/ESP8266 Wi-Fi Attacks

#41

Post by monocasa »

gioscarab wrote: post #20
fra wrote: post #14

First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…

Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".

And honestly it's a little harder than Broadcom's to reverse. Xtensa doesn't have nearly the same support in reversing tools as ARM and MIPS. On the plus side though you do get unstripped binaries since it's a static library.

Re: ESP32/ESP8266 Wi-Fi Attacks

#42

Post by gioscarab »

monocasa wrote: post #41
gioscarab wrote: post #20

Earlier quoted context omitted.

Espressif have not released the sources of the WiFi implementation, just binaries. I would define that as "security through obscurity".

And honestly it's a little harder than Broadcom's to reverse. Xtensa doesn't have nearly the same support in reversing tools as ARM and MIPS. On the plus side though you do get unstripped binaries since it's a static library.

I agree, it is for sure harder to reverse, on the other side without releasing the source, it is also much easier to hide in and keep secret vulnerabilities and or zero-days.

Re: ESP32/ESP8266 Wi-Fi Attacks

#43

Post by tinus_hn »

gioscarab wrote: post #16
Klathmon wrote: post #13

Well that sucks. I have probably 20 esp8266 chips around the house doing various things (when you can get an MCU for like $2, you find a lot more uses!), but I don't think any of them really need to worry about this aside from the DoS attacks taking them offline. I'll need to maybe look into some alerts when they start going offline, but not much. I'm not familiar with the Enterprise WPA2 stuff. Is it widely used in…

Reading carefully the documents presented by the author Enterprise mode seems to be even less secure than the normal WiFi mode. Quite ironic I agree.

Enterprise requires everyone to use a different key while wireless communication in a group wants traffic to be possible between the clients directly and broadcasted. That’s conflicting.

Re: ESP32/ESP8266 Wi-Fi Attacks

#44

Post by sixothree »

Etheryte wrote: post #10

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories. These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi",…

I have a bunch of these around the house and garage. I never would have expected them to be secure against an attack.

Re: ESP32/ESP8266 Wi-Fi Attacks

#45

Post by tialaramex »

mpettitt wrote: post #25

The fake beacon frame issue is the key one here - relatively few people are using Enterprise WPA2, but ESP8266 (or compatible - such as the Tuya TYWE3S) chips are in all kinds of random low cost IoT devices. I've got some smart plugs which use them, as well as a few of the dev boards connected up to various sensors, so looks like will have some patching to do...

I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise.

Without Enterprise, there's just one magic shared key "password" known to every user of the network.

The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leveraging TLS to actually make this secure one way or another.

This enables, for example, EduROAM in which academics and students use their "home" institution credentials to get network access in any participating educational network.

Re: ESP32/ESP8266 Wi-Fi Attacks

#46

Post by kyledrake »

This is interesting for screwing up badges at Defcon, but I wouldn't lose too much sleep over it. They're neat devices but not really used for anything critical. I'm also not sure they're being used for a lot of consumer devices. If you war drived a major hackerspace you might reset an led light art project.

Re: ESP32/ESP8266 Wi-Fi Attacks

#47

Post by microtonal »

stefan_ wrote: post #21
fra wrote: post #14

First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif's chips. Most of their competitors (I'm looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there. That being said, the status quo is completely untenable. Connectivity has…

Uhh, their WiFi implementation is hacked-together old open source code distributed as statically linked binary blobs. And that is just the software part, there isn't much visibility into the silicon side..

Plus they are a Shanghai-based company and can be compelled by the Chinese government to place hardware back doors.

(They are great for makers though, very affordable, lots of features.)

Re: ESP32/ESP8266 Wi-Fi Attacks

#48

Post by emilfihlman »

baybal2 wrote: post #23
Etheryte wrote: post #10

For those unfamiliar with the topic, these two chips are by and far the most common wifi chips for DIY and are also very common in IoT devices. Due to cheap price ($2—$5 depending on the model) and very low barrier to entry technically, these devices are both very popular as well as very wide spread in those two categories. These chips are the first hits for searches such as "Arduino wifi module", "breadboard wifi",…

I'd say Espressif has a near monopoly due to first comer advantage. There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet. Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions…

>I'd say Espressif has a near monopoly due to first comer advantage.

No. Espressif is used because it is _cheap_ and has relatively good support libraries. Just the chips/modules from other vendors are usually 15 to 20€ in single quantities while you can get an ESP8266 minimum development board (almost all normal arduino boards are minimum development boards) for like 3€.

Unless other vendors reach that same level, they will always stay back.

Re: ESP32/ESP8266 Wi-Fi Attacks

#49

Post by microtonal »

solarkraft wrote: post #28
baybal2 wrote: post #23

Earlier quoted context omitted.

I'd say Espressif has a near monopoly due to first comer advantage. There are way, way more moneyed companies in the wifi MCU game, but I have not seen a single competitor chip outside sales demos yet. Redpine had big dotcoms backing, but it seems that even they dropped the ball on them in favour of Chinese chipmakers. Amazon and Google recently reached out for MXCHIP and Espressif, and their Redpine based solutions…

Realtek has the RTL8710, which is a lot like the ESP8266 but with an ARM Cortex-M3 (while Espressif uses the rather obscure Xtensa architecture), which has the advantage of getting an LLVM toolchain for it, which means you can program it in Rust (while the ESPs are mostly limited to C). The real advantage of the ESP8266 however is its raw popularity. It has an Arduino environment, tons of ready to run sketches, Basic…

Realtek has the RTL8710, which is a lot like the ESP8266 but with an ARM Cortex-M3 (while Espressif uses the rather obscure Xtensa architecture), which has the advantage of getting an LLVM toolchain for it, which means you can program it in Rust (while the ESPs are mostly limited to C).

Any recommendations for good, affordable dev boards (say under 20Euro/USD), that are easily available?

(I have been playing with RobotDyn Blue Pills and Rust, but no wireless or Bluetooth connectivity.)

Re: ESP32/ESP8266 Wi-Fi Attacks

#50

Post by microcolonel »

rohansingh wrote: post #37
microcolonel wrote: post #12

Yeah, I've caused some of these crashes. The IDF needs a lot of work when it comes to some of the stacks. I've been trying to bring the Bluetooth stack (which shares a common ancestor with the Android one) closer to the current Android Bluetooth stack, since that's well maintained (ish) and I'm extending it.

Have you seen that the latest ESP-IDF includes Apache's NimBLE stack? I'm hoping that improves things a bit.

Maybe, I'll have to look into that. My application is an A2DP enhancement, and I think it would be at least a bit of work to implement an A2DP service in NimBLE; very cool nonetheless, thanks for bringing it up!
Post reply on HN