OTA update security about anavi-thermometer-sw HOT 8 CLOSED

I'm using signed builds, so nobody should be able to upgrade my thermometers. This should be recommended in the documentation. An attacker might still be able to cause a denial of service and/or wear out the flash, though. Some more protection is a good idea.

I've mounted my thermometers so that I can't reach the reset button unless I unscrew 4 screws, so personally I don't like the third option. :-)

I would prefer to have a whitelist of acceptable servers embedded in the firmware. It could
perhaps default to the default gateway that was obtained via DHCP?

from anavi-thermometer-sw.

To enable signed builds is actually really easy (if you run the arduino IDE on Linux or Mac). The support is already there. See this link:

https://arduino-esp8266.readthedocs.io/en/2.5.0/ota_updates/readme.html#advanced-security-signed-updates

Disclaimer: I have not tried to upload an unsigned upgrade, so I'm not actually sure this works...

from anavi-thermometer-sw.

The #10 merge request is my proposal on how this should be fixed.

from anavi-thermometer-sw.

@bschwehn, @cederlys, thank you both for the contributions and the involvement. What do you think about adding an additional WiFiManagerParameter for the OTA update? It could be just enable/disable or several options (like off, on, on only from local webservers or with request for pressing the reset button).

Thanks,
Leon

from anavi-thermometer-sw.

I'm using signed builds, so nobody should be able to upgrade my thermometers. This should be recommended in the documentation.

I am not familiar with signed builds, I guess you need to update the bootloader first?

I've mounted my thermometers so that I can't reach the reset button unless I unscrew 4 screws, so personally I don't like the third option. :-)

Right, I agree, that would be annoying :)

I think whitelisting either the gateway / current subnet or all private IP ranges is reasonable.
Possibly with button activation for other adressess/as fallback in addition.

I don't think we have to be overly paranoid, I just don't think it's a good default option...

from anavi-thermometer-sw.

@bschwehn, @cederlys, thank you both for the contributions and the involvement. What do you think about adding an additional WiFiManagerParameter for the OTA update? It could be just enable/disable or several options (like off, on, on only from local webservers or with request for pressing the reset button).

I think this would be good first user experience. But, I think most people will not use the initial setup again after setting it up once (I at least don't). Perhaps both can be added. I can have a look in the next few days.

from anavi-thermometer-sw.

Now I have tried to upload an unsigned upgrade. It worked more or less as expected. The
upgrade was rejected, and the thermometer resumed operations. I found one minor issue:
an error message is printed to the serial console. This is fixed by this pull request:
#9

However, during the upgrade, the thermometer won't do anything else but downloading
the new image. So it is possible to mount a denial-of-service attack. Having some kind
of whitelist would be good.

Perhaps OTA should be disabled by default, and enabled by entering the IP address or
domain name of an OTA server as a WiFiManagerParameter? We could also allow the
user to add

#define OTA_SERVER "apache.example.com"

to the sketch and accept that as well.

If we have locked the update server to a particular server, I think we don't need
confirmation via a button press.

from anavi-thermometer-sw.

Thanks! (Also for the additional info you provided, I was busy with other things so far, but will try using signed updates soon)

from anavi-thermometer-sw.