<story><title>ESP32/ESP8266 Wi-Fi Attacks</title><url>https://github.com/Matheus-Garbelini/esp32_esp8266_attacks</url></story><parent_chain><item><author>fra</author><text>First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif&amp;#x27;s chips. Most of their competitors (I&amp;#x27;m looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there.&lt;p&gt;That being said, the status quo is completely untenable. Connectivity has become the norm in the hardware space, and it is built on a shoddy software foundation. Vendor SDKs are often best effort endeavors provided &amp;quot;as is&amp;quot; with no thought given to security or reliability. The results are clear: &amp;quot;the S in IOT stands for security&amp;quot; has become a trope, and connected cameras, locks, washing machines, and many more are getting owned on a weekly basis.&lt;p&gt;This will change, and whoever cracks this nut will be very successful indeed.</text></item></parent_chain><comment><author>stefan_</author><text>Uhh, their WiFi implementation is hacked-together old open source code distributed as statically linked binary blobs. And that is just the software part, there isn&amp;#x27;t much visibility into the silicon side..</text></comment>
<story><title>ESP32/ESP8266 Wi-Fi Attacks</title><url>https://github.com/Matheus-Garbelini/esp32_esp8266_attacks</url></story><parent_chain><item><author>fra</author><text>First and foremost, this speaks to the ubiquity and hacker friendliness of Espressif&amp;#x27;s chips. Most of their competitors (I&amp;#x27;m looking at you, Broadcom), prefer security through obscurity and make it extremely difficult to get access to chips, let alone SDKs. I am certain that similar vulnerability exist in every embedded WiFi chipset out there.&lt;p&gt;That being said, the status quo is completely untenable. Connectivity has become the norm in the hardware space, and it is built on a shoddy software foundation. Vendor SDKs are often best effort endeavors provided &amp;quot;as is&amp;quot; with no thought given to security or reliability. The results are clear: &amp;quot;the S in IOT stands for security&amp;quot; has become a trope, and connected cameras, locks, washing machines, and many more are getting owned on a weekly basis.&lt;p&gt;This will change, and whoever cracks this nut will be very successful indeed.</text></item></parent_chain><comment><author>kees99</author><text>Vulnerabilities in Broadcom&amp;#x2F;Cypress wifi chips&amp;#x27; firmware have been known for a while now:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.exodusintel.com&amp;#x2F;2017&amp;#x2F;07&amp;#x2F;26&amp;#x2F;broadpwn&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.exodusintel.com&amp;#x2F;2017&amp;#x2F;07&amp;#x2F;26&amp;#x2F;broadpwn&amp;#x2F;&lt;/a&gt;</text></comment>