By what mechanism are IoT widgets vulnerable to hacking?

Question

I hear news stories that millions of thermostats and fridges have not been properly secured by their manufacturers. I could understand how something running linux with sshd running (as it might well be to enable development) could be accessed.

I am just starting to play with ESP8266, and want to know whether it is safe or vulnerable. If the latter, what should I do to secure it.

Because I struggle with new environments, I am trying to take a well-trodden and well-tutorialled route. I am therefore starting with a Node MCU development board (they seem to be very popular and I've found some what appear to be excellent step by step videos), and intending to use the arduino core tools (as I can already handle arduino) via the USB port. I plan to implement a web server on it, that can be accessed manually from a browser, or automatically by python. The application is driving simple lab test gear, so voltmeter, thermometer, relay outputs etc. I am only going to implement control of test gear via the network, I am not going to attempt any form of software development, that will be exclusively via USB. It's intended to work purely on my local network, behind a router, I'm not going to do anything intentionally to forward ports.

Once connected with my home network, is there anything hidden in the Node MCU or arduino core environment that has backdoors that could render it vulnerable to hacking? Are there any setup mistakes I could make that would make it so? Is there any difference in running it in station or AP mode?

Answer 1

I'd say the risk is fairly low for your ESP8266, given that:

• you're not forwarding ports, so any attacker would have to be inside your network already to be able to access the ESP8266. This wouldn't stop an attack if another device was compromised, but if that had happened, you would have big problems anyway.

• you're only deploying software via a physical USB connection, so if an attacker does gain access, they can't really do a lot. I would be more concerned if over-the-air updates were enabled because the damage that could be caused is greater—your ESP8266 could then be remotely controlled and have full access to your network in that case.

Probably the most well-known IoT worm, Mirai, did not use any elaborate method of hacking devices. It simply connected to public IPs looking for a suitable login page, and tried various default passwords. If one of them worked, and it was a suitable Linux system, it installed itself and took over the device (deleting any other malware in the process).

An ESP8266 is less likely to be vulnerable just by the fact that they're not all that common, but relying on that alone would be unwise. If those devices had used a secure password, however, the Mirai worm would not have succeeded.

A slightly less notorious but still well-documented worm is Reaper, which exploits known bugs in some common devices. This only really works for devices that are known to have flaws (and are worth targeting).

As far as I know, there are no major issues with the ESP8266 in the way you're proposing to use it. So long as the port is not forwarded, it's going to be fairly difficult for anyone to attack it; just be sure to check that you definitely cannot access it from outside the network.

Answer 2

As with everything in this space, it's a question of what your threat model is. Who (bored teenager, script kiddy, Mafia backed hacker for hire, all the away up to hostile foreign government...) are you trying to defend against and what is the cost of them succeeding (unable to turn your kitchen light on from your phone, to burning down the house).

The examples of devices forming huge bot nets to carry out DDOS attacks for groups tends to be more aimed at things running at the more capable end of the spectrum (e.g. a webcam running and embedded linux distro).

But even just having a relatively simple device (something running on a esp8266) connected to your home wifi can be used as a vector for somebody to break into the the network e.g. a connected kettle that leaks your wifi password.

While @Aurora001's answer is pretty good, I'd disagree with the ESP8622 not being common, they show up in a lot more places than you think, but a lot depends on what firmware they are running.

Given your use case, you're probably fine especially if hardcode the WiFi details and don't use some of the frameworks that bring the device up in AP mode first to allow configuring the WiFi.