Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unveiling secrets of the ESP32: creating an open-source MAC layer

zeus.ugent.be

Post reply on HN
Print view View original

101–110 of 157 posts

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#101

Post by brunohaid »

finnjohnsen2 wrote: post #13

I wasnt aware of this wifi blob. This feeds a tiny paranoia I have at the back of my head when dealing with esp32/espressif. I have dozens of esp32s around and I love them, but Espressif is 100% Chinese. Im uncomfortable with what I read that every company of significant size in China automatically requires CCP party members to be involved in the company at a high level. So Im very happy to hear people such as these…

> Maybe Nordic Semiconductors will make some nice risk-v chips and dev-boards soon.

They are, not as CPU necessarily but for exactly those auxiliary functions: https://blog.nordicsemi.com/getconnected/why-nordic-is-getti...

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#102

Post by wkat4242 »

RF_Savage wrote: post #75
finnjohnsen2 wrote: post #13

I wasnt aware of this wifi blob. This feeds a tiny paranoia I have at the back of my head when dealing with esp32/espressif. I have dozens of esp32s around and I love them, but Espressif is 100% Chinese. Im uncomfortable with what I read that every company of significant size in China automatically requires CCP party members to be involved in the company at a high level. So Im very happy to hear people such as these…

It is because of FCC certification requirements. Usually, if the end user can modify the lowlevel radio firmware on the device, the device looses it's FCC certification and cannot be sold in USA. It also seems that Espressif has bought their wifi IP, so their contracts and licensing terms with the IP vendor likely prevent any sharing. But FCC is the reason for closed binary blob firmware for all wifi radios out there…

Expressif also block some cool packet injection things like sending malformed packets in their firmware. Which is not illegal to offer. They probably are afraid of getting a bad reputation.

This is why open firmware can be really handy for the security community.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#103

Post by wkat4242 »

RF_Savage wrote: post #94
dariosalvi78 wrote: post #83

Earlier quoted context omitted.

I don't understand how the license affects certification TBH. As this post clearly shows users can implement their own stack if they really want to, it's not that the license is going to prevent them. Why can't one have an open source stack with specific builds that are approved, tested and certified?

They could, but somebody would have to write that FOSS wifistack. You could not run selfcompiled versions of the stack on any hardware that has been FCC certified, because if you could, the certs would be gone once again. Wifi is shared spectrum and devices using are licenced to make sure they conform to the local regulations. One size does not fit all. For example 2.4GHz wifi channel 13 is legal in EU, but in USA it…

Is that really why? I know many devices where I can just set whatever country I want :)

This is handy sometimes because in the EU it's the opposite, the 5 and 6 GHz bands are much smaller.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#104

Post by wkat4242 »

SamBam wrote: post #54
asylteltine wrote: post #31

Earlier quoted context omitted.

I restrict my esps to local network only absolutely no internet access for them. No trust for Chinese products from Chinese companies

The vast majority of people who use ESP-32 smart devices, however, probably just give it the password to their WiFi.

There is of course a limit to how much damage a device with such limited capacity can do.

And with the amount of tinkering that happens with these, if it were calling home someone would really have figured it out by now.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#105

Post by dezgeg »

no_time wrote: post #99

the esp32 also has a mask ROM (which includes BASIC for some weird reason). Hence fully deblobbing it is a hopeless battle. https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32/ap...

I would guess most 32-bit microcontrollers and any SoCs capable of running Linux have some sort of boot ROM, at least for the flash programming mode (especially if it's over USB).

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#106

Post by wkat4242 »

no_time wrote: post #99

the esp32 also has a mask ROM (which includes BASIC for some weird reason). Hence fully deblobbing it is a hopeless battle. https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32/ap...

Nothing an electron microscope can't handle. It's not a hardened security chip. It'll cost a bit but it's probably possible for a company to do it for free to show off their services. This is how die shots usually happen.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#107

Post by rfoo »

wkat4242 wrote: post #102
RF_Savage wrote: post #75

Earlier quoted context omitted.

It is because of FCC certification requirements. Usually, if the end user can modify the lowlevel radio firmware on the device, the device looses it's FCC certification and cannot be sold in USA. It also seems that Espressif has bought their wifi IP, so their contracts and licensing terms with the IP vendor likely prevent any sharing. But FCC is the reason for closed binary blob firmware for all wifi radios out there…

Expressif also block some cool packet injection things like sending malformed packets in their firmware. Which is not illegal to offer. They probably are afraid of getting a bad reputation. This is why open firmware can be really handy for the security community.

Given that they are originated from China, I'm not surprised.

For a while (not any more though) you can't sell an ACR122U RFID card reader online in China, just because mfoc [1] supports it nicely and it got a reputation of "smart card cloner".

[1] https://github.com/nfc-tools/mfoc

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#108

Post by wkat4242 »

fragmede wrote: post #47
vGPU wrote: post #45

Earlier quoted context omitted.

I’ve actually found that ESPHome is sufficient for most basic use cases

The question then is where have you found ESPHome to fall short?

It ends up losing contact with home assistant regularly for me. All my devices do this (all based on 8266's anyway) and all devices will fall into unavailable for a few seconds. Which is annoying because their return can trigger automations.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#109

Post by dariosalvi78 »

RF_Savage wrote: post #94
dariosalvi78 wrote: post #83

Earlier quoted context omitted.

I don't understand how the license affects certification TBH. As this post clearly shows users can implement their own stack if they really want to, it's not that the license is going to prevent them. Why can't one have an open source stack with specific builds that are approved, tested and certified?

They could, but somebody would have to write that FOSS wifistack. You could not run selfcompiled versions of the stack on any hardware that has been FCC certified, because if you could, the certs would be gone once again. Wifi is shared spectrum and devices using are licenced to make sure they conform to the local regulations. One size does not fit all. For example 2.4GHz wifi channel 13 is legal in EU, but in USA it…

So it's perfectly feasible to have an open source Wifi, or Bluetooth or any other RF, stack, but only certain compiled versions are actually certified. I understand that the openness in this case would be limited: you lose the freedom to modify and run the software as you wish (unless you want to risk to break the law), but you can still help bugfix, improve the software and verify that there no backdoors / spying features.

The reason sometimes given by vendors that "FCC demands the code to be proprietary" is an excuse.

Re: Unveiling secrets of the ESP32: creating an open-source MAC layer

#110

Post by redfast00 »

rkfjrjrkfnrkd wrote: post #12

This is very interesting. I'm keen to get involved but, while I'm very experienced with ESP32, I don't have experience with this type of reverse engineering. How long did it take you to get the environment and tools set up, so you could start digging in? Is time or money a more valuable investment at this stage? If it's not too forward, how much would be useful to your organisation? (I can email if preferred.)

Please contact me via email (at the bottom of the blog post)
Post reply on HN