I hear news stories that millions of thermostats and fridges have not been properly secured by their manufacturers. I could understand how something running linux with sshd running (as it might well be to enable development) could be accessed.
I am just starting to play with ESP8266, and want to know whether it is safe or vulnerable. If the latter, what should I do to secure it.
Because I struggle with new environments, I am trying to take a well-trodden and well-tutorialled route. I am therefore starting with a Node MCU development board (they seem to be very popular and I've found some what appear to be excellent step by step videos), and intending to use the arduino core tools (as I can already handle arduino) via the USB port. I plan to implement a web server on it, that can be accessed manually from a browser, or automatically by python. The application is driving simple lab test gear, so voltmeter, thermometer, relay outputs etc. I am only going to implement control of test gear via the network, I am not going to attempt any form of software development, that will be exclusively via USB. It's intended to work purely on my local network, behind a router, I'm not going to do anything intentionally to forward ports.
Once connected with my home network, is there anything hidden in the Node MCU or arduino core environment that has backdoors that could render it vulnerable to hacking? Are there any setup mistakes I could make that would make it so? Is there any difference in running it in station or AP mode?