Are there any best practices regarding password safety? The following is taken from a wifi tutorial sketch.

#include <SPI.h>
#include <WiFi.h>

char ssid[] = "yourNetwork";      // your network SSID (name) 
char pass[] = "secretPassword";   // your network password
int keyIndex = 0;                 // your network key Index number (needed only for WEP)

While I accept that the tutorial is there for learning how to use the shield, I would assume hard coding the password into the sketch leaves this open to attackers. Is this actually the case? If so, are there any strategies to harden the sketch, for example with encrypted storage?

I am a relative newbie with physical computing and Arduino, so sorry if I am overlooking something obvious.

  • 1
    Any system which needs to communicate a password between an MCU and a standard wifi module in cleartext is readily open to attack by anyone who has physical access just by sniffing the serial, spi, or whatever channel in between them. The tools to do so sell for $6-24. – Chris Stratton Aug 5 '16 at 19:49
  • You'll have to physically secure the Arduino device, as the attacker has to have physical access to the Arduino to get to the password. In corporate environments, they would set up a separate wifi network, with a firewall, to reduce the risks when that network is compromised. – Gerben Aug 6 '16 at 9:27
  • On the avoiding hard-coding front, I just found this: instructables.com/id/… It basically creates its own network to address the bootstrapping issue. Which makes this a nice way to package a device for someone else to use, too. – Dilum Ranatunga Aug 14 at 3:43

You're actually entering into a very tricky and difficult area.

Yes, having a plain text password in your sketch is a risk. It is stored in flash as plain text. If an attacker can gain access to the contents of the flash through some means (whatever they may be) then they could obtain that WiFi password.

You would think that encrypting the password would be the answer, but that's not the case. The problem with an encrypted password like this is it has to be decrypted to use it. That means that both the encrypted password and the encryption key are both stored together in flash. If you can get one you can get the other, and thus the encryption is null and void. Encryption security relies on keeping the encrypted data and the key used to encrypt/decrypt it completely separate. After all, you don't leave the key to your house in the front door lock when you go out, do you? It's exactly the same.

So what do you do?

Well, there's lots of different ways of looking at security. In this case there is one specific viewpoint that works best:

Security Through Obscurity

Your system is (pretty much) unique. Nobody but you knows just what it does and how it does it, or how you interact with it. It's not obvious to the casual observer just what it is or what could be done with it. That means that they won't know how to break in to it.

The majority of use of vulnerabilities in systems rely on those systems being ubiquitous - that is, all over the place; easy to obtain. In short, easy to find out what they are, how they work, and even reverse engineer them to a certain extent. Attackers aren't going to be able to do that with your system, since you are the only person in the world with it.

However, it's far from perfect, and you shouldn't rely only on Security Through Obscurity.

Simple obfuscation of the password (not actual encryption, but just storing it in a way that isn't obvious) can help, since it isn't then easy to see where in a memory dump the password would be. Splitting it up and scattering it around the place, too, can be useful.

Basically there is no simple answer, other than make it as hard for an attacker to find sensitive things as possible and don't tell anyone what you have done to hide it ;)

| improve this answer | |
  • Level-up to Majenko for the thorough breakdown. I've seen some crypto libraries for arduino, and your only concern is the key for your string. I have used some bits unique to systems (and which could be grabbed from C, once just a username and hostname) when I had to obfuscate strings, but I don't think that's a good practice. If attackers (who attack your arduino, inside your house perhaps?) dump its memory, you probably have bigger problems which require a shotgun. But if you insist, I recommend finding some bits unique to the mcu (serial number perhaps) and XOR'ing the wpa key with that. – user400344 Aug 7 '16 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.