So you want to play with Wi-Fi? It’s dangerous to make frames alone. Take this(cybersecurity.blog.aisec.fraunhofer.de) |
So you want to play with Wi-Fi? It’s dangerous to make frames alone. Take this(cybersecurity.blog.aisec.fraunhofer.de) |
> [...] Another major limitation of the hardware this driver supports is its limitation to 2.4GHz 802.11 b/g, with most devices also supporting n and/or draft-n.
This is wrong. ath9k is not limited to 2.4GHz. I have two dual-band ath9k cards with 5GHz support: 168c:002a (AR9280) and 168c:0030 (AR9380). Both are still available on ali.
This article aims to be the collected wisdom of everything I learned while trying to fuzz the Wi-Fi stack of Espressifs esp8266.I might have missed something but why can’t an ESP32 or some other microcontroller be used as a hardware tool to more easily construct low level frames?
The ESP32 would still be connected to a Linux machine to control it.
I’m not a security researcher so I don’t know how this work is normally done. My simplistic take is if the OS and drivers make some of this hard I would look for a simpler environment that I had more control over.
Or it that too naive an approach?
Second, the more practical limitation comes from the fuzzing objective: esps are slowwwww, and the testcase throughput is abysmal; especially if you factor in that the firmware is essentially a black box and the usual coverage-guidance used in modern fuzzing simply does not work on a device that constrained.
So yeah - constructing frames on the esp would be the smart thing to do, figuring out how to do this efficiently (and fully automated) is however not trivial at all. FWIW, hooking the board up to a computer via serial is also not enough, the fuzzer needs some way to hard reset devices (that is, pull the reset pin to ground or powercycle or both). We use some extra microcontrollers we had lying around for that, however we needed to make some custom PCBs to make that work reliable.
Edit: also, to clarify, the esp8266 is even more limited than the esp32. There is no officially supported way to construct raw frames on the 8266, and in/out connections other than wifi are limited to fairly low speed UART (no JTAG, etc..).