Journal of Internet Computing and Services (인터넷정보학회논문지)

Korean Society for Internet Information (한국인터넷정보학회)
권호 표지
DOI QR코드

DOI QR Code

A Study on Vulnerability Analysis and Memory Forensics of ESP32

  • Jiyeon Baek (Dept. of Future Convergence Technology Engineering, Sungshin Women's University) ;
  • Jiwon Jang (Dept. of Future Convergence Technology Engineering, Sungshin Women's University) ;
  • Seongmin Kim (Dept. of Convergence Security Engineering, Sungshin Women's University)
  • Received : 2024.01.27
  • Accepted : 2024.04.17
  • Published : 2024.06.30
Download PDF
⟨ Previous Next ⟩

Abstract

As the Internet of Things (IoT) has gained significant prominence in our daily lives, most IoT devices rely on over-the-air technology to automatically update firmware or software remotely via the network connection to relieve the burden of manual updates by users. And preserving security for OTA interface is one of the main requirements to defend against potential threats. This paper presents a simulation of an attack scenario on the commoditized System-on-a-chip, ESP32 chip, utilized for drones during their OTA update process. We demonstrate three types of attacks, WiFi cracking, ARP spoofing, and TCP SYN flooding techniques and postpone the OTA update procedure on an ESP32 Drone. As in this scenario, unpatched IoT devices can be vulnerable to a variety of potential threats. Additionally, we review the chip to obtain traces of attacks from a forensics perspective and acquire memory forensic artifacts to indicate the SYN flooding attack.

Keywords

Acknowledgement

This work is supported by the Ministry of Trade, Industry and Energy (MOTIE) under Training Industrial Security Specialist for High-Tech Industry (RS-2024-00415520) supervised by the Korea Institute for Advancement of Technology (KIAT), and the Ministry of Science and ICT (MSIT) under the ICAN (ICT Challenge and Advanced Network of HRD) program (No. IITP-2022-RS-2022-00156310) supervised by the Institute of Information & Communication Technology Planning & Evaluation (IITP).

References

  1. The Korea Herald, "IoT devices hacking statistics", http://news.koreaherald.com/view.php?ud=20220119000736
  2. Yonhap News, "Home cameras hacking statistics", https://en.yna.co.kr/view/AEN20221220009100315
  3. H. Jeon, and S. Lee, "Analysis of Remote Update Vulnerabilities of IoT Healthcare Devices," Journal of KIIT, Vol. 19, No. 1, pp. 87-97, 2021. http://dx.doi.org/10.14801/jkiit.2021.19.1.87
  4. Espressif, https://www.espressif.com/
  5. Espressif, "ESP32-S2 Series Datasheet", https://www.espressif.com/en/products/devkits
  6. O. Barybin, E. Zaitseva, and V. Brazhnyi, "Testing the Security ESP32 Internet of Things Devices", 2019 IEEE International Scientific-Practical Conference Problems of Infocommunications, Science and Technology (PIC S&T), 2019. http://dx.doi.org/10.1109/PICST47496.2019.9061269
  7. Z. Li, H. Ren, E. Chou, X. Liu, and C. D. McAllister, "Retrieving Forensically Sound Evidence from the ESP Series of IoT Devices", IEEE Internet of Things Journal, Vol. 9, No.15, pp. 13144-13152, 2022. http://dx.doi.org/10.1109/JIOT.2022.3144164
  8. Aircrack-Ng,https://www.kali.org/tools/aircrack-ng/
  9. Wordlists,https://www.kali.org/tools/wordlists/
  10. Ettercap Project, https://www.ettercap-project.org/
  11. Wireshark, https://www.wireshark.org
  12. Hping3, https://www.kali.org/tools/hping3/
  13. Espressif, "ESP32-WROOM-32 Datasheet", https://www.espressif.com/sites/default/files/documentation/esp32-wroom-32_datasheet_en.pdf
  14. Espressif, "Esptool.py Documentation", https://docs.espressif.com/projects/esptool/en/latest/esp32/
  15. Espressif, "ESP-IDF API Guides", https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/partition-tables.html
  16. ESP32 Tutorials, http://www.lucadentella.it/en/2016/12/22/esp32-4-flash-bootloader-e-freertos/
  17. B. Pearson, L. Luo, Y. Zhang, R. Dey, Z. Ling, M. Bassiouni, and X. Fu, "On Misconception of Hardware and Cost in IoT Security and Privacy", In ICC 2019-2019 IEEE International Conference on Communications (ICC), 2019. http://dx.doi.org/10.1109/ICC.2019.8761062
  18. Winmerge, https://winmerge.org/
  19. ESP32 Networking APIs. Espressif, https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/network/esp_wifi.html
  20. Hackers are increasingly targeting Zero-Day Vulnerabilites.Business Wire, https://www.businesswire.com/news/home/20220126005014/en/Ransomware-2021-Year-End-Report-Reveals-Hackers-are-Increasingly-Targeting-Zero-Day-Vulnerabilities-and-Supply-Chain-Networks-for-Maximum-Impact