5

Let's say I have an arduino Uno connected to a W5100 ethernet shield. The arduino communicates with the ethernet shield using the tx0 and rx0 pins. When I upload a new script to the arduino using USB, it uses the same tx0 and rx0. So that made me think.

What if I run a script on my arduino that fetches some data from a webpage using HTTP requests but someone manages to hack into my server. Is it possible for the hacker to upload some kind of code to my server, which will erase (when fetched by the arduino) the old script and upload a new arduino script, by making the arduino think it's uploading a new script while it's getting data from the ethernet shield (or other communication shields?)

EDIT: Let's expand the question a bit.. How can I add security to my code to prevent this situation from happening?

  • Ask on infosec.EE . Use memory buffers prudently and don’t worry. – user2497 Feb 12 '18 at 17:54
  • Everything is hackeable. – user31481 Feb 12 '18 at 18:29
  • You are not expanding the question “quite a bit”: you are opening a vast subject. Lots have been written about how to handle untrusted data, and about the kind of errors you should avoid. In any case, your new question would be more appropriate in security.stackexchange.com – Edgar Bonet Feb 12 '18 at 21:52
  • @EdgarBonet Oh no that's not what I meant by that. Just point me in the right direction like you did. – Orry Vandermeulen Feb 12 '18 at 22:12
6

You should be pretty safe, at least as long as your code handles the incoming data properly.

When you upload a new sketch through USB, the USB-to-serial interface uses the Arduino pins TX0, RX0 and RESET. Your Ethernet shield, on the other hand, does not control the RESET pin. Pulling the RESET pin LOW is needed to make the processor enter the bootloader, which in turn is needed in order to upload a new program. For pulling this pin low, the malicious code would need not only to break into the Ethernet shield's firmware, it would also need a hardware hack to access the pin.

Now, if your own code is not safe, it is conceivable that the malicious payload tricks your program into jumping to the bootloader or, as suggesting by Juraj, into triggering a watchdog reset (which ends up being equivalent). Thus you should treat anything coming from the network as potentially malicious.

  • However, NodeMCU can perform OTA (over the air updates) which is very nice for uploading software remotely, but then anyone can upload a new sketch unless you implement your own security. – user31481 Feb 12 '18 at 18:47
  • 1
    @LookAlterno: Right, but at the hardware level, NodeMCU is a completely different beast. – Edgar Bonet Feb 12 '18 at 18:57
  • different beast with not open source chinese code deep inside :) – Juraj Feb 12 '18 at 20:36
  • if the downloaded data could trigger the watchdog reset, and the Ethernet shield had STK500 programmer in firmware then a hack hex could be written into avr :) – Juraj Feb 12 '18 at 20:41
  • 1
    @EdgarBonet, I know, just wanted to point out that writing of the hex is not just sending it to tx/rx – Juraj Feb 13 '18 at 4:47
1

No it's not possible. Assuming you mean this shield (and if you don't, please clarify):

Arduino communicates with both the W5100 and SD card using the SPI bus (through the ICSP header). This is on digital pins 10, 11, 12, and 13 on the Uno and pins 50, 51, and 52 on the Mega.

Further on it mentions:

The shield contains a number of informational LEDs:

...

RX: flashes when the shield receives data

TX: flashes when the shield sends data

That's Rx and Tx on the shield, not the Arduino. Since it does not connect to the Tx/Rx on the Arduino, and since it cannot reset the Arduino, it therefore cannot reprogram it.

If you are worried, disable the BOOTRST fuse on the Arduino so that the bootloader is not active after a reset.

If you are really worried, disable the SPIEN fuse so that you cannot even reprogram it using SPI. Of course, then you won't be able to reprogram it either.

Personally I would be more worried that a cockatoo would come and peck at the shield.

  • Birds are not to be trusted. – Cort Ammon Feb 12 '18 at 22:26
  • The bird problem is a serious concern. – user2497 Feb 13 '18 at 12:27
  • Great answer!! But now another problem arises, I have an aviary in my garden, should I get rid of it? – Orry Vandermeulen Feb 13 '18 at 15:40
  • If you have cockatoos, I would advise caution. As Wikipedia says: They can be a nuisance in urban areas due to destruction of property ... Birds may also target external wiring and fixtures such as solar water heaters, television antennae and satellite dishes. – Nick Gammon Feb 13 '18 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.