Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ESP32/ESP8266 Wi-Fi Attacks

github.com

Post reply on HN
Print view View original

91–100 of 152 posts

Re: ESP32/ESP8266 Wi-Fi Attacks

#91

Post by cortesoft »

derefr wrote: post #82
squarefoot wrote: post #55

Earlier quoted context omitted.

Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can…

> I can't imagine any manufacturer risking their business by replying "nope, we won't comply" How about the risk to their business when a multinational corporation is X-raying their cores for backdoors (as one does) and finds the state backdoor, and then decides to no longer do business with the hardware manufacturer because of it—and also publicizes the existence of the backdoor, such that other multinationals pull…

Has this happened?

Re: ESP32/ESP8266 Wi-Fi Attacks

#92

Post by gerdesj »

exhilaration wrote: post #84
gerdesj wrote: post #32

Earlier quoted context omitted.

Just to give you some idea of how easy these are to use: In 20 mins with a small breadboard, a few Dupont wires, a Nodemcu ESP8266, a DHT22 with a pull up resister I've got a desk temperature sensor. Add: https://esphome.io/ ... and it talks MQTT and connects straight into Home Assistant.

No soldering needed?

Yes, no soldering. Here's an example of the sort of thing that is sat on my desk:

https://lastminuteengineers.com/esp8266-dht11-dht22-web-serv...

If a NodeMCU board is too big for you then an ESP 01S is smaller and even cheaper. Less I/O options though but very useful. Needs a writer and wires to program. You can get one with a relay that is capable of switching 16A.

https://frenck.dev/diy-smart-doorbell-for-just-2-dollar/ - here's an example of a project. $2 is a bit ambitious I spend £7 for two of them on Amazon. That's two ESP-01S and two relays!

I don't do Arduino. esphome is a lot easier for me. You use pip to get the thing installed under your user account. Write a .yaml file which is largely copy and paste from examples and then install it through a USB cable the first time and then over the air after that.

Re: ESP32/ESP8266 Wi-Fi Attacks

#93

Post by codebje »

acidburnNSA wrote: post #3

This appears to be the relevant thread on the Arduino ESP8266 page: https://github.com/esp8266/Arduino/issues/6016 Looks like it was closed due to "lack of info". I wonder if that caused some bad blood?

Looks like it was a question about where to report it, followed by a handful of suggestions and _then_ the close. I don't see any reason for bad blood from that, especially since there was a bit of follow-on discussion and by the look of it, a fix was released a couple of weeks back.

Re: ESP32/ESP8266 Wi-Fi Attacks

#94

Post by ClumsyPilot »

baybal2 wrote: post #64
emilfihlman wrote: post #48

Earlier quoted context omitted.

>I'd say Espressif has a near monopoly due to first comer advantage. No. Espressif is used because it is _cheap_ and has relatively good support libraries. Just the chips/modules from other vendors are usually 15 to 20€ in single quantities while you can get an ESP8266 minimum development board (almost all normal arduino boards are minimum development boards) for like 3€. Unless other vendors reach that same level, t…

First comer advantage is huge. I work with a mid sized engineering consultancy. We began switching to ESP as our primary platform just around 2 years ago, just as wifi gadgets were starting to boom. To date, we got 500 megs of MCU project in our repo. Though most of code is repetitive, there is no chance we will part with such a huge codebase. Being able to complete a $200k project in a few weeks through code reuse,…

Why do you call it first mover advantage when there were wifi MCUs before it?

Re: ESP32/ESP8266 Wi-Fi Attacks

#95

Post by codebje »

mendesgeo wrote: post #30
djsumdog wrote: post #27

So is there any way to mitigate these vulnerabilities, or does it require replacing the hardware?

The silicon vendor Espressif has already patched the last firmware (SDK) of such devices. However, other products that uses this chips with still have to patch against it.

The beautiful part of IoT is how there's billions of devices out in the wild with no upgrade plan.

The ESP chips are OTA capable with example code provided, but that still means vendors have to incorporate the function, provide a way for the device to check for updates, care enough to produce updates, and secure the upgrade mechanism enough that it's not a worse vulnerability than an unpatched device.

Re: ESP32/ESP8266 Wi-Fi Attacks

#96

Post by ClumsyPilot »

watsocd wrote: post #58

It's fine to say we want everything as secure as possible. But what about the tradeoff between a system being easy to connect/use and making it so difficult to connect that hobbyist users can't get the device to work. If you are doing mission critical or life-safety related work with $3 devices, you are doing it wrong. Spend a little more and use something else. In my case, I am monitoring room temperatures in my hou…

Actually I think it's easier to make cheap, mass produced device secure because you have loads of eyes to check the code.

Re: ESP32/ESP8266 Wi-Fi Attacks

#97

Post by squarefoot »

nabla9 wrote: post #68
squarefoot wrote: post #55

Earlier quoted context omitted.

Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can…

> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.

9/11 changed everything.

Re: ESP32/ESP8266 Wi-Fi Attacks

#98

Post by bscphil »

tialaramex wrote: post #45
mpettitt wrote: post #25

The fake beacon frame issue is the key one here - relatively few people are using Enterprise WPA2, but ESP8266 (or compatible - such as the Tuya TYWE3S) chips are in all kinds of random low cost IoT devices. I've got some smart plugs which use them, as well as a few of the dev boards connected up to various sensors, so looks like will have some patching to do...

I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise. Without Enterprise, there's just one magic shared key "password" known to every user of the network. The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leve…

So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)?

If the latter, can I make my own real eduroam AP?

Re: ESP32/ESP8266 Wi-Fi Attacks

#99

Post by acidburnNSA »

codebje wrote: post #93
acidburnNSA wrote: post #3

This appears to be the relevant thread on the Arduino ESP8266 page: https://github.com/esp8266/Arduino/issues/6016 Looks like it was closed due to "lack of info". I wonder if that caused some bad blood?

Looks like it was a question about where to report it, followed by a handful of suggestions and _then_ the close. I don't see any reason for bad blood from that, especially since there was a bit of follow-on discussion and by the look of it, a fix was released a couple of weeks back.

Yeah, on second read I agree with you. I'm just wondering why the public PoC disclosure before that team had more chance to fix. The arduino-esp8266 folks are super popular in the ESP community.

By my read, the fix is still open in that repo, tracked by the follow-up issue: https://github.com/esp8266/Arduino/issues/6436

Re: ESP32/ESP8266 Wi-Fi Attacks

#100

Post by baybal2 »

ClumsyPilot wrote: post #94
baybal2 wrote: post #64

Earlier quoted context omitted.

First comer advantage is huge. I work with a mid sized engineering consultancy. We began switching to ESP as our primary platform just around 2 years ago, just as wifi gadgets were starting to boom. To date, we got 500 megs of MCU project in our repo. Though most of code is repetitive, there is no chance we will part with such a huge codebase. Being able to complete a $200k project in a few weeks through code reuse,…

Why do you call it first mover advantage when there were wifi MCUs before it?

What was before were not MCUs as such, but a zoo of spi wifi + mcu "solutions" from rentier companies like broadcom.

Technically, and conceptually they were hopelessly behind an integrated WiFi MCU.

Post reply on HN