2 ms·

Does this allow device owners to recover or replace the firmware in abandoned/EOLed (by the vendor) IoT devices? If that's true, then maybe this is a good thin

Does this allow device owners to recover or replace the firmware in abandoned/EOLed (by the vendor) IoT devices? If that's true, then maybe this is a good thing?

laurowyn 2y ago
It's absolutely a good thing, and arguably not a security issue at all. It needs access to the command interface of the chip, which means you need to either have physical access to the device or compromise whatever is physically connected to the device. It's practically like calling a read/write filesystem a security issue. Yes, an attacker can write to disk and persist there, and they can overwrite files, etc. But there needs to be a flaw that allows access to that behaviour first, else it's just a part of the interface. And in this instance, it's a part of the debug interface of the chip. And practically makes it a perfect candidate for future bluetooth security tools, similar to the Atheros chipsets used for WiFi sniffing. Now we can do bluetooth impersonation attacks for $2 instead of hundreds. Betting there'll be some good bluetooth research in the near future, showing all sorts of devices are vulnerable to attacks using $2 hardware. That's the real security problem here.
unsnap_biceps 2y ago
esp devices are generally super easy to replace the firmware on. I have PetLibro Water Fountains that use a weight sensor powered by a esp32. I opened the base, attached three wires to the uart output on the processor, flashed esphome firmware and loaded it into home assistant, completely cloud free monitoring. The undocumented instructions isn't a backdoor at all, it requires you to have local access or have already taken control over the firmware via another bug. The only thing that people going nuts over a "backdoor" will do is cause espressif to close up their interfaces, which would make it harder in the future to repurpose the hardware.

Does this allow device owners to recover or replace the firmware in abandoned/EOLed (by the vendor) IoT devices? If that's true, then maybe this is a good thing?

laurowyn 2y ago

It's absolutely a good thing, and arguably not a security issue at all. It needs access to the command interface of the chip, which means you need to either have physical access to the device or compromise whatever is physically connected to the device. It's practically like calling a read/write filesystem a security issue. Yes, an attacker can write to disk and persist there, and they can overwrite files, etc. But there needs to be a flaw that allows access to that behaviour first, else it's just a part of the interface. And in this instance, it's a part of the debug interface of the chip. And practically makes it a perfect candidate for future bluetooth security tools, similar to the Atheros chipsets used for WiFi sniffing. Now we can do bluetooth impersonation attacks for $2 instead of hundreds. Betting there'll be some good bluetooth research in the near future, showing all sorts of devices are vulnerable to attacks using $2 hardware. That's the real security problem here.

unsnap_biceps 2y ago

esp devices are generally super easy to replace the firmware on. I have PetLibro Water Fountains that use a weight sensor powered by a esp32. I opened the base, attached three wires to the uart output on the processor, flashed esphome firmware and loaded it into home assistant, completely cloud free monitoring. The undocumented instructions isn't a backdoor at all, it requires you to have local access or have already taken control over the firmware via another bug. The only thing that people going nuts over a "backdoor" will do is cause espressif to close up their interfaces, which would make it harder in the future to repurpose the hardware.