IEEE Consumer Electronics Magazine - May/June 2023 - 77

Firmware Analysis Regarding firmware vulnerabilities,
most Arduino systems run without
OS. Non-OS Arduino boards are programmed by
executing a set of instructions in their microcontroller3.
These instructions can be written using
the Arduino software and uploaded to the board.
Arduino boards include a ready-to-use installed
bootloader, which may be a door to a malicious
third party if he has access to the
hardware.34 This default bootloader helps developers
to quickly install a program using a UARTUSB
wire directly connected to the Arduino
board. If a malicious third party has USB-hardware
access to the board, he will be able to easily
upload a new firmware.
Arduino default bootloader adds some delay
on booting. This delay is between around 1.5 s on
the latest versions to 10 s on the oldest ones. In
some environments, like drone controllers, this
booting delay can lead to dangerous situations.
Luckily, the default bootloader can be rewritten
or completely deleted using an external programmer.35
If the bootloader is removed, firmware
reprogramming can only be done using the external
programmer. This requires a new piece of
hardware and higher skills to reprogram the
hardware.
If an attacker has an external programmer and
access to the boards, the firmware in binary format
may be extracted because the flash memory
data is not encrypted.36 The downloaded code
can be afterward disassembled and converted in
human-readable code using tools like HexRays.
In order to prevent a third unauthorized
actor to access the firmware, the security bit of
the microcontroller can be activated. However,
this bit does not prevent a program on the bootloader
from reading the flash memory. Then, in
order to secure completely the flash memory,
the bootloader must be deleted.
As with any other software, Arduino firmware
can be attacked exploiting buffer overflow bugs in
order to get access to unauthorized data. This
attack modifies normal application flow by writing
data in unexpected memory addresses.37
Even though this attack is complex to perform on
Arduino microcontrollers due to its stack operation,
it is not impossible. This kind of attack can
be really dangerous as an attacker could even execute
bootloader code to overwrite the firmware.
FIGURE 1. Cross-compiler AVR-GCC complains
about stack protector option.
Arduino microcontrollers have reduced
memory size. For that reason, bad designed software
will end up in fatal states if memory is full.
Full SRAM avoids the sketch to run as expected
and there is no easy way to detect this problem.38
Arduino development and testing requires
attention and good practices to avoid full-memory
problems.
When developing with Arduino, stack vulnerabilities
must be avoided during development,
as running-time protections are not available.
Protection techniques like Address Space Layout
Randomization (ASLR) or Stack Canaries that
can avoid some stack attacks are not supported
for AVR devices. If we try to compile any application
using stack protection options, the compiler
will complain about it (see Figure 1).
Communication Analysis Communication
stack implementations are also vulnerable to
attacks. Both Arduino MEGA with Ethernet connection,
MKR 1010 on Wi-Fi and Arduino UNO
with Ethernet shield, tolerate an SYN flooding
attack and an HTTP DoS attack. While attacks
are being performed, the access to the servers
becomes almost impossible. However, once
attacks stop, server becomes accessible again
with no need to restart the board.
Arduino MEGA with the Wi-Fi shield loses connection
after only 100 ICMP packets sent on few
seconds. After the attack, the MEGA board does
not answer any more ping requests neither to web
requests (see Figure 2). In order to recover the
connection on the board, a full reboot is required.
Regarding Wemos D1R2, the board has stability
problems as soon as a DoS attack starts.
These boards constantly reboots because of an
May/June 2023
77
IEEE Consumer Electronics Magazine - May/June 2023

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May/June 2023
