Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

Post by vorpalhex » Thu, Nov 21, 2019, 9:40 PM UTC

jdnenej wrote: post #10

LeifCarrotson wrote: post #6

This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…

Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.

Post by monocasa » Thu, Nov 21, 2019, 9:43 PM UTC

XorNot wrote: post #8

monocasa wrote: post #4

Earlier quoted context omitted.

It does, but major part of flash encryption is to protect your supply chain. Ie. to keep people from cloning your boards and just dumping your software on them. It's also a bit of security through obscurity (which despite the memes can be an important piece of defense in depth) to make the MCUs a bit more difficult to attack if you don't know the code that's running.

Except an attacker operating at that scale would just start decapping the chips and inspecting them.

Post by jdnenej » Thu, Nov 21, 2019, 9:48 PM UTC

vorpalhex wrote: post #11

jdnenej wrote: post #10

Earlier quoted context omitted.

Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.

This would be more akin to jailbreaking your nintendo switch and installing linux. An IOT platform that's intended to be secure can be tricked into revealing it's key. Most consumers aren't going to write custom firmware for their lightbulbs. Of course, I think this exploit is impractical for a lot of cases given how the ESP32 is typically used, but, ymmv.

Post by jdnenej » Thu, Nov 21, 2019, 9:50 PM UTC

derefr wrote: post #14

jdnenej wrote: post #10

Earlier quoted context omitted.

Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.

One user's self is another user's attacker. This attack isn't one-time; if I can break into the hardware and change the keys such that I now control it, then someone else with temporary physical access can then break into my hardware and change the keys again , suborning "my" IoT device into e.g. a subtle wiretap. A computer anyone—not just the owner —can root given physical access, is like a lock that anyone—not jus…

Post by jdc » Thu, Nov 21, 2019, 9:52 PM UTC

vorpalhex wrote: post #11

jdnenej wrote: post #10

Earlier quoted context omitted.

Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.

This would be more akin to jailbreaking your nintendo switch and installing linux. An IOT platform that's intended to be secure can be tricked into revealing it's key. Most consumers aren't going to write custom firmware for their lightbulbs. Of course, I think this exploit is impractical for a lot of cases given how the ESP32 is typically used, but, ymmv.