4 ms·

Building an open-source Wi-Fi Mac layer for the ESP32

161 points by pabs3 2y ago

pabs3 2y ago
A list of other open source firmware: https://wiki.debian.org/Firmware/Open https://wiki.debian.org/Firmware/Open
iou 2y ago
Timely post with the vulnerability research this week? https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-...
- dugite-code 2y ago
  That was related to Bluetooth. Interesting undocumented low level commands but it's a bit of a stretch to call it a vulnerability IMHO. But having the whole stack open would just be better in general.
  - gibibit 2y ago
    Correct. HN thread https://news.ycombinator.com/item?id=43301369 https://news.ycombinator.com/item?id=43301369 Not a vulnerability in the way that Tarlogic makes it sound. Disingenuous and misleading article for sure.
    - nottorp 2y ago
      A good bunch of "security" articles that make the news look more like scareware to me in the past years.
- luma 2y ago
  This outfit has changed the term "backdoor" to mean "any undocumented feature". The findings reported are absolutely not a backdoor in any conventional usage of the term. One would need to flash their own code to the micro to make use of these features, which is the normal operating mode for any micro device. This is nothing other than a security research team trying to get some attention by crying wolf.
- mystified5016 2y ago
  This isn't a backdoor, it's just an undocumented debugger in the HCI stack. You still need a physical UART connection to the device AFAIK. The exact same type of connection you use to program and debug the device normally.
megamix 2y ago
I’d like someone to explain this to me as I find this interesting. I have tech background but the OSI model is not something I’ve interacted with directly. Some questions I come to think of 1. Why ESP32 made it closed? 2. What does the MAC layer in the OSI model make it so important to either make this closed/open source ? From the article: "security auditability", possibility for features not supported, make research into Wi-Fi networks with lots of nodes more affordable. E.g. ESP32 is proprietary, but it doesn’t limit the connection to certain routers, but could it be made to be?
- pvtmert 2y ago
  i'm also not professional networking engineer but overall open core will allow; better interfacing and integration as a wifi chip on SBCs like raspberry pi, potentially allowing faster rates and lower latencies on SPI or I2c buses better security and possibly handling further standards than the espressif allows. for example, you may implement wpa3 or wpa4 (if it comes out at some point) without needing to wait for espressif to implement and release themselves. plus, they may never have the incentives to do so if a newer chip (esp64?) comes out...
  - mannyv 2y ago
    One big win might be power savings.
- magnat 2y ago
  1. They might have used IP cores with license that forbids disclosing any technical details, including firmware implementation. 2. Manipulating RF registers could cause the device to operate outside of regulatory parameters, perhaps invalidating FCC certification for the whole device. By not disclosing how to use MAC directly, they can claim they did their best to prevent device from misbehaving.
  - xattt 2y ago
    There’s many devices that can get uncapped (Yaesu handhelds for example) without losing FCC certification.
bastard_op 2y ago
I was watching the 38c3 talk about this a few months ago, and just laughed seeing the recent news. Guess they have a good reason to be paranoid, hmm. https://youtu.be/r8IqkUTGjlA https://youtu.be/r8IqkUTGjlA
deleted 2y ago
[deleted]
hackburg 2y ago
[dead]

161 points by pabs3 2y ago

A list of other open source firmware: https://wiki.debian.org/Firmware/Open https://wiki.debian.org/Firmware/Open

iou 2y ago

Timely post with the vulnerability research this week? https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-...

dugite-code 2y ago
That was related to Bluetooth. Interesting undocumented low level commands but it's a bit of a stretch to call it a vulnerability IMHO. But having the whole stack open would just be better in general.
- gibibit 2y ago
  Correct. HN thread https://news.ycombinator.com/item?id=43301369 https://news.ycombinator.com/item?id=43301369 Not a vulnerability in the way that Tarlogic makes it sound. Disingenuous and misleading article for sure.
  - nottorp 2y ago
    A good bunch of "security" articles that make the news look more like scareware to me in the past years.
luma 2y ago
This outfit has changed the term "backdoor" to mean "any undocumented feature". The findings reported are absolutely not a backdoor in any conventional usage of the term. One would need to flash their own code to the micro to make use of these features, which is the normal operating mode for any micro device. This is nothing other than a security research team trying to get some attention by crying wolf.
mystified5016 2y ago
This isn't a backdoor, it's just an undocumented debugger in the HCI stack. You still need a physical UART connection to the device AFAIK. The exact same type of connection you use to program and debug the device normally.

megamix 2y ago

I’d like someone to explain this to me as I find this interesting. I have tech background but the OSI model is not something I’ve interacted with directly. Some questions I come to think of 1. Why ESP32 made it closed? 2. What does the MAC layer in the OSI model make it so important to either make this closed/open source ? From the article: "security auditability", possibility for features not supported, make research into Wi-Fi networks with lots of nodes more affordable. E.g. ESP32 is proprietary, but it doesn’t limit the connection to certain routers, but could it be made to be?

pvtmert 2y ago
i'm also not professional networking engineer but overall open core will allow; better interfacing and integration as a wifi chip on SBCs like raspberry pi, potentially allowing faster rates and lower latencies on SPI or I2c buses better security and possibly handling further standards than the espressif allows. for example, you may implement wpa3 or wpa4 (if it comes out at some point) without needing to wait for espressif to implement and release themselves. plus, they may never have the incentives to do so if a newer chip (esp64?) comes out...
- mannyv 2y ago
  One big win might be power savings.
magnat 2y ago
1. They might have used IP cores with license that forbids disclosing any technical details, including firmware implementation. 2. Manipulating RF registers could cause the device to operate outside of regulatory parameters, perhaps invalidating FCC certification for the whole device. By not disclosing how to use MAC directly, they can claim they did their best to prevent device from misbehaving.
- xattt 2y ago
  There’s many devices that can get uncapped (Yaesu handhelds for example) without losing FCC certification.

bastard_op 2y ago

I was watching the 38c3 talk about this a few months ago, and just laughed seeing the recent news. Guess they have a good reason to be paranoid, hmm. https://youtu.be/r8IqkUTGjlA https://youtu.be/r8IqkUTGjlA

deleted 2y ago

[deleted]

hackburg 2y ago

[dead]