21–30 of 78 posts
Props for the effort, but who expects a cheap china MCU for consumer products to be resilient against glitching attacks? You don’t use that stuff in high-security settings anyway. For consumers products resilient to advanced hardware attacks, I can only think of the iPhone and some consoles. Anything else?
Forgive my ignorance, but what would one use?
i.e. what's the high-sec equivalent of a esp32?
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
A perfect example of how this could be a problem would be the modification of a utility providers smart meter. The home owner hacks the firmware of their electicity meter to show a 10% reduction of power consumption.
Im sure there are several more applications of this exploit that would allow end users who are not the owners of the hardware to make it a threat large enough for manufacturers to consider using a more secure device.
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
If so this is a fairly serious hack especially for devices that auto-update OTA.
Earlier quoted context omitted.
This would be more akin to jailbreaking your nintendo switch and installing linux. An IOT platform that's intended to be secure can be tricked into revealing it's key. Most consumers aren't going to write custom firmware for their lightbulbs. Of course, I think this exploit is impractical for a lot of cases given how the ESP32 is typically used, but, ymmv.
The point of locking out game consoles owners is to protect the software vendors. What's the point with IoT?
This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…
Might as well call the PC a broken platform since you can install your own OS. Imo a platform is broken if the user can't control it.
More like calling a PC broken if you can install your own OS even after you've enabled Secure Boot and a TPM (in which case, the security features are objectively broken)
Props for the effort, but who expects a cheap china MCU for consumer products to be resilient against glitching attacks? You don’t use that stuff in high-security settings anyway. For consumers products resilient to advanced hardware attacks, I can only think of the iPhone and some consoles. Anything else?
>You don’t use that stuff in high-security settings anyway. Forgive my ignorance, but what would one use? i.e. what's the high-sec equivalent of a esp32?
Props for the effort, but who expects a cheap china MCU for consumer products to be resilient against glitching attacks? You don’t use that stuff in high-security settings anyway. For consumers products resilient to advanced hardware attacks, I can only think of the iPhone and some consoles. Anything else?
>You don’t use that stuff in high-security settings anyway. Forgive my ignorance, but what would one use? i.e. what's the high-sec equivalent of a esp32?
Some additional info is in Espressif's notification (CVE-2019-17391) which is linked to in the write up: https://www.espressif.com/en/news/Security_Advisory_Concerni... The fix is in ESP32-D0WD-V3 and ESP32-WROVER-E, but of course that doesn't do you any good if you've already shipped product.
Perhaps because it would use up more space in the ROM? If so, I wonder what functionality they dropped from the ROM to add it now? I somehow doubt they made the ROM bigger - that would be very expensive at this stage of the chips lifecycle.
I'm wondering, how many companies that use ESP32 actually use the firmware security feature?
It's used on most consumer devices simply to slow down clone devices being created.
> Vulnerability n*2: No security settings (at all)