Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

limitedresults.com

Post reply on HN
Print view View original

61–70 of 78 posts

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#61

Post by baybal2 »

planteen wrote: post #51

I've heard e-fuses in general are vulnerable to optical inspection under polarized light after deliding a part. So if someone capable really wanted to clone a device, it's very possible they already were able to get the e-fuse key values. I once used the e-fuse feature of another part for bootloader integrity. I wasn't worried about encryption, but the part would validate the bootloader integrity when encrypted. If i…

Indeed, this is the reason ICs used in credit cards don't use them, but embedded flash can still be mechanically probed, and this is how EMV cards are allegedly being cloned

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#62

Post by baybal2 »

viraptor wrote: post #39
kbumsik wrote: post #16

I'm wondering, how many companies that use ESP32 actually use the firmware security feature?

Almost everyone who's selling a real device, in my experience. It's pretty standard to disable firmware reads in embedded cpu products.

And from my experience, it's virtually none.

Since I first started work in OEM electronics in 2007, I only saw that being requested 3 times.

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#63

Post by glennpratt »

noonespecial wrote: post #23
LeifCarrotson wrote: post #6

This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…

If I'm not mistaken, buying one of a device and tearing it down like this would yield keys that would let you create "official" firmwares for all of the other ones of their kind and set up a fake update site allowing you to remote exploit all of the others, yes? If so this is a fairly serious hack especially for devices that auto-update OTA.

That's not how public/private encryption works, which is what comes to mind when you say keys. Not that I have any clue how this actually works!

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#64

Post by Arnt »

swiley wrote: post #49
jeremyjh wrote: post #37

Earlier quoted context omitted.

Just piggy backing on the top comment to point out that the primary concern here is not necessarily for the security of the devices that you own and physically control (although that could be an issue in some cases, if others can access them too), but for the IP of the OEM which can now be extracted and flashed to cloned boards. So this may well be a serious issue for some of Espressif's customers, who are mostly OEM…

In other words, it’s good for users, who’s should have access to the source much less the binary anyway.

I think you mean that the owners should have.

Owners have physical access to their devices, but so do others. It's far from obvious to me that as owner, I benefit from elevated privileges, when anyone with temporary physical access also get the same elevated privileges.

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#65

Post by baybal2 »

petra wrote: post #60
baybal2 wrote: post #59

Earlier quoted context omitted.

> So this may well be a serious issue for some of Espressif's customers, who are mostly OEMs I highly doubt that. From what I know, that feature was more of a nod to their customers from the West. To most Chinese entrepreneurs, it makes no sense how your software being copied be an issue: 1. If you have a real specific reason why disclosure of your code be an end to your business, it will get hacked and copied anyway…

So how do Chinese Entrepreneurs maintain competitive advantage and profit ?

Think a bit yourself. If you struck gold, you have zero chance not being cloned.

1. Do not strike gold — look for an easily entrechable position in niche market, like a lot of companies in US do

2. Economies of scale — works until your competitor bribes a banker for a giant loan

3. Be one step ahead — look at FAB business. In microelectronics fabrication, everybody copy each other, and you can't do anything about it, but somehow companies still maintain their positions

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#66

Post by zaarn »

michaelt wrote: post #40
LeifCarrotson wrote: post #6

This is an interesting attack, and certainly looks highly successful in terms of allowing a determined hardware hacker to gain root/bootloader access to a device that the manufacturer has attempted to lock them out of. Glitching with a 6V supply on a 3.3V bus is certainly something I'd want to be a little cautious of if the hardware was more expensive than a $10 dev board - I wouldn't buy a $800 IoT fridge and use th…

> Isn't that a good thing for me as a consumer? I like the ability to decrypt and modify my own devices. If you're the sort of person who buys wifi-based-internet-enabled door bells, but you don't want someone who steals your doorbell to (a) be able to extract your wifi password or (b) be able to get the thing to work at all, you might appreciate resistance to the thief's attacks. Of course, you can also address this…

This could still be addressed by not putting the wifi part of the doorbell into the doorbell itself or alternatively using something like LoRaWAN where at worst someone could compromise the device keys (which you can reprovision) so your Wifi isn't compromised at all.

Another solution is to use a second gateway inside the house that manages the Wifi part and secure communication with the doorbell via short range radio.

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#69

Post by userbinator »

petra wrote: post #60
baybal2 wrote: post #59

Earlier quoted context omitted.

> So this may well be a serious issue for some of Espressif's customers, who are mostly OEMs I highly doubt that. From what I know, that feature was more of a nod to their customers from the West. To most Chinese entrepreneurs, it makes no sense how your software being copied be an issue: 1. If you have a real specific reason why disclosure of your code be an end to your business, it will get hacked and copied anyway…

So how do Chinese Entrepreneurs maintain competitive advantage and profit ?

By cloning and then improving.

Re: Pwn the ESP32 Forever: Flash Encryption and SEC. Boot Keys Extraction

#70

Post by sokoloff »

SlowRobotAhead wrote: post #56
jeremyjh wrote: post #37

Earlier quoted context omitted.

Just piggy backing on the top comment to point out that the primary concern here is not necessarily for the security of the devices that you own and physically control (although that could be an issue in some cases, if others can access them too), but for the IP of the OEM which can now be extracted and flashed to cloned boards. So this may well be a serious issue for some of Espressif's customers, who are mostly OEM…

I have a product in the field, Chinese clones are on the market using my firmware that was pulled via voltage glitch. Two things, 1. You know you’ve made it when there is a Chinese clone of your product. 2. I’ll never use that chip again.

What chip (family) would you use instead if firmware protection is important to your application?
Post reply on HN