search

adafruit / Adafruit_nRF52_Bootloader

USB-enabled bootloaders for the nRF52 BLE SoC chips
MIT License
428 stars 380 forks source link

Any way to secure against OTA DFU? #42

Open lbdroid opened 5 years ago

lbdroid commented 5 years ago

On instructions https://github.com/adafruit/Adafruit_nRF52_Arduino/issues/218#issuecomment-455039283, I'm re-posting this issue against what is apparently a more appropriate repository.

Looking through the literature on these as carefully as I can, I've come across reference to a mode referred to as "OTA DFU", which can apparently be triggered by Nordic's nRF Toolbox application, allowing the storage memory to be rewritten over an unsecured bluetooth connection.

I've also seen indication that there is absolutely no security on this functionality at all: #162 (comment)

What I need to be able to do is disable this mode altogether, or in the very least, be able to program it with an update key that I (and only I) am in control of. This "feature" otherwise presents a security hole that makes it completely unsuitable for any application that has even fringe security related implications.

rabih9780 commented 5 years ago

Do you guys have an update on this?

ladyada commented 5 years ago

no ETA

rabih9780 commented 5 years ago

What would it take to implement secure DFU into this library? upgrade sdk?

ladyada commented 5 years ago

a complete rewrite

lbdroid commented 5 years ago

According to this comment; https://github.com/adafruit/Adafruit_nRF52_Arduino/issues/218#issuecomment-479990008

The issue of somebody randomly taking over your device via unsecured DFU mode has at least been mitigated. DFU mode is not enabled unless you explicitly enable it.

In other words, while DFU mode is still not implemented securely, at least you have to tell it to switch to that mode before it is possible to rewrite the firmware using it.

So if you need to implement DFU updates, you could arrange it so that you need to send it a secure command to switch DFU mode on, then use DFU mode, and reboot to resume DFU-disabled mode.

Edit: See this commit; https://github.com/adafruit/Adafruit_nRF52_Arduino/commit/865ac99c7feac0298ee3c5d842eb537904ab10ae

CSC-Sendance commented 1 year ago

Hi, sorry for necromancing this.

We have been investigating this issue increasingly and found that WebBluetooth explicitly blocks Nordic's update service, making it impossible to do via WebBluetooth (see https://github.com/WebBluetoothCG/registries/blob/master/gatt_blocklist.txt ).

Is there an ETA by now (since it seems to be on the roadmap) or maybe even work in progress-branch we could support in for this bootloader to do the Nordic Secure OTA DFU? It would be greatly appreciated also if you clearly state that this is planned or not.

robsonos commented 6 months ago

Hi,

I am also interested in this feature because of the WebBluetooth blocklist. @CSC-Sendance in the meantime, a good alternative is to use a different UUID for the DFU service.

Cheers.