Authentication is a decimal PIN in a uint32_t, sent over cleartext telnet, and
compared on every keystroke inside the read loop:
clientn[i].passwd = clientn[i].passwd * 10 + (ch & 0xf);
...
if (clientn[i].passwd == eeprom_read_u32(PASSWD0)) { /* authenticated */ }Consequences:
- Default password is
0, so pressing Enter logs you in.
- A password that is a numeric prefix of what you type matches early.
- The accumulator can overflow
uint32_t with no guard.
- The only penalty is 5 seconds, and there is no source-address filtering.
- Everything, including the serial console contents, crosses the network in the
clear.
This is not fixable on an ATmega328. There is no room for TLS and no entropy
source. Filed so the tradeoff is written down rather than rediscovered.
Mitigation is operational: put these boards on an isolated management VLAN
behind a jump host, and treat anyone with L2 access to that VLAN as having
console access to every managed machine.
Longer term the alternative is PROC-V2 (ESP8266), but its web UI has its own
problems — default root/admin, HTTP Basic over plaintext, and an
unauthenticated recovery mode — so it is not obviously an improvement.
Authentication is a decimal PIN in a
uint32_t, sent over cleartext telnet, andcompared on every keystroke inside the read loop:
Consequences:
0, so pressing Enter logs you in.uint32_twith no guard.clear.
This is not fixable on an ATmega328. There is no room for TLS and no entropy
source. Filed so the tradeoff is written down rather than rediscovered.
Mitigation is operational: put these boards on an isolated management VLAN
behind a jump host, and treat anyone with L2 access to that VLAN as having
console access to every managed machine.
Longer term the alternative is PROC-V2 (ESP8266), but its web UI has its own
problems — default
root/admin, HTTP Basic over plaintext, and anunauthenticated recovery mode — so it is not obviously an improvement.