Pwn the ESP32 Forever - Page 1
Forum section: electronics / general

author: bitwelder
author_rank: Super Contributor
timestamp: November 14, 2019, 10:00:50 am
content: Cool, security researchers are beginning to dig deep into ESP32 architecture as well,finding h/w flaws:https://limitedresults.com/2019/11/pwn-the-esp32-forever-flash-encryption-and-sec-boot-keys-extraction/Quote

author: GeorgeOfTheJungle
author_rank: Super Contributor
timestamp: November 14, 2019, 10:39:08 am
content: Paper courtesy of NXP/ST/TI/ARM :-)

author: OwO
author_rank: Super Contributor
timestamp: November 14, 2019, 12:50:54 pm
content: I can't think of any MCU where code encryption isn't broken though. It is an inherently hard problem and any sane engineer should assume physical access = root. I'm only concerned about remote code execution or other privilege escalation vulnerabilities.

author: artag
author_rank: Super Contributor
timestamp: November 14, 2019, 12:54:58 pm
content: Totally agree.This might be a problem to those neanderthals that still think keeping their code secret is both viable and useful, but the only way it exposes end users is with the possibility of replacing code on their device with an unauthorised trojan. Which could be done just as easily, if physical access is available, by simply replacing the device.

author: janoc
author_rank: Super Contributor
timestamp: November 14, 2019, 01:41:10 pm
content: Quote from: artag on November 14, 2019, 12:54:58 pmDo you mean 90% of the software world by those "neanderthals"? Because having the software out in the open is notthatcommon.The issue is that that a trojan could be potentially deployed remotely, through another, remotely exploitable and by itself not a very dangerous flaw. Such attacks are pretty routine these days. That something requires local access to exploit doesn't make it any less problematic.Also, not every exploit is there to turn the device into a botnet zombie or to steal the end user's data. Sometimes stealing the firmware or breaking into the device itself is more valuable. People on this forum regularly complain about Chinese cloners ripping them off, so I would assume something like that could be quite an issue? Also, the flash on these devices often contains things such as wifi keys/passwords, making an easy-to-break IoT device an ideal target for gaining access into the network.

author: Twoflower
author_rank: Frequent Contributor
timestamp: November 14, 2019, 01:58:24 pm
content: Quote from: GeorgeOfTheJungle on November 14, 2019, 10:39:08 amI think ST, like Intel, has currently its own problems with the security of the keys in the TPM devices:http://tpm.fail

author: artag
author_rank: Super Contributor
timestamp: November 14, 2019, 05:37:47 pm
content: @janoc : all true, but that doesn't make me wrong.Neanderthals were still neanderthals even when in the majority. They got out-evolved. Similarly, relying on locked up firmware to protect your IP when you ship kit that contains it (ie physical access) is doomed to failure. It's an obsolete business model.

author: OwO
author_rank: Super Contributor
timestamp: November 14, 2019, 06:07:46 pm
content: Quote from: janoc on November 14, 2019, 01:41:10 pmDoesn't apply in this case because you have to glitch the power supply at just the right time...

author: janoc
author_rank: Super Contributor
timestamp: November 14, 2019, 09:15:36 pm
content: Quote from: OwO on November 14, 2019, 06:07:46 pmFair enough, I saw the paper after I wrote that.

author: janoc
author_rank: Super Contributor
timestamp: November 14, 2019, 09:17:46 pm
content: Quote from: artag on November 14, 2019, 05:37:47 pmExcept that obsolete business model is still powering most of the world's economy. And will be for the foreseable future, because not everything can be stuffed in the cloud or totally locked down like an ATM machine. Open sourcing things is not a solution neither, for both economic and regulatory reasons in many cases.So this pontificating about "neanderthals" is cute as a soundbite, but that's about all it is.

author: artag
author_rank: Super Contributor
timestamp: November 15, 2019, 03:42:21 pm
content: As is pretending that something that worked for a limited time will work forever.See dinosaurs, music industry, etc. for practical examples.It might take a while, but open source will ultimately win because of 'standing on the shoulders of giants'. Designs that are closed and eventually thrown away rather than evolve and grow are a dead end. They may have short-term wins but they don't scale.Regulatory issues are irrelevant : open source does not necessarily mean that uncontrolled installations happen and regulatory regimes will adapt to keep themselves relevant.

author: Marco
author_rank: Super Contributor
timestamp: November 15, 2019, 11:32:58 pm
content: Secure boot should be protected by pki, not symmetric encryption ... wtf were they thinking?

author: thm_w
author_rank: Super Contributor
timestamp: November 16, 2019, 12:36:36 am
content: Quote from: artag on November 15, 2019, 03:42:21 pm"Dinosaurs" is not even close to being a relevant example."Music industry" still exists so not sure what your point is there, I assume you mean the transition from physical to software media?https://www.musicbusinessworldwide.com/global-recorded-music-industry-revenues-grew-8-1-in-2017-to-reach-17-3bn/