7 ms·
But what do you do when it's the radio firmware itself that has a security for and the vendor stopped patching their devices? It's a pain in the ass to secure a
by m-p-3 7y ago
But what do you do when it's the radio firmware itself that has a security for and the vendor stopped patching their devices? It's a pain in the ass to secure a closed source binary blob.
Example: https://hackaday.com/2019/09/05/esp8266-and-esp32-wifi-hacked/ https://hackaday.com/2019/09/05/esp8266-and-esp32-wifi-hacke... what if Espressif dropped support for these a while ago? You couldn't securely use these in some scenarios without reverse-engineering the binary blobs and patching the flaws. And I can't imagine how many of IoT devices out there use that chip or a derivative.
- wtallis 7y agoThose Espressif blobs are running on the same processor as the application/OS and are responsible for a lot more functionality than the typical radio firmware for a Broadcom/Qualcomm/Mediatek WiFi NIC that connects over PCIe. That firmware is also entirely different from the RF regulatory data I was talking about; the regulatory data should be in a ROM somewhere but the WiFi firmware generally needs to be stored alongside and updated in lockstep with the operating system's driver for the WiFi device.
- milankragujevic 7y agoMost routers have the SoC integrating the radio chip, and running firmware and the OS on the same silicon.
- wtallis 7y agoWireless router SoCs usually have at most one radio integrated, and the 5Ghz radio is still usually attached over PCIe. And even the integrated 2.4Ghz radio's firmware is running on entirely separate processor cores and in a different memory address space from the application processor.
- milankragujevic 7y agoI did not know that the firmware for the radio is running in a different context (memory space/processor). I assumed they would, to save cost, run everything together.