0

After reviewing similar topics I've decided to ask this question below in the Security Stackexchange forum about 11 days ago. https://security.stackexchange.com/questions/235423/is-arduino-mega-hackable-over-the-air

No one gave an answer yet, perhaps I was wrong about the medium that's why I am also posting the question here.

I am collecting data (by reading input registers) from a machine by RS-485 protocol and Arduino Mega 2560 hardware.

I am also sending this data from Arduino Mega to a NodeMCU which is connected to the internet over WiFi.

I made 100% sure that no physical interference can be performed on the hardware I setup.

But since this machine, I collect data from is controllable (by writing holding registers) over RS-485 (I've tested it) I have to make sure that Arduino's software cannot be changed/re-programmed/flashed over the air by someone.

There is no other device than NodeMCU which is open to the Internet and can be the source of vulnerability. And the only physical connections between Arduino & NodeMCU ar TX3+RX3 pins and power+ground pins.

I do not really care if the data or WiFi password or cloud server credentials are stolen. The only thing I care about is that Arduino is not flashed over the air which can ultimately damage the machine I am taking data from. Do you think this setup is safe regarding the information I present to you?

1
  • I suggest you consult the ATmega datasheet. There you will find that the chip can only be flashed from within the boot loader region. This gives no 100% guarantee. But further down the datasheet you will find several fuses that you can evaluate. Some of them disable the boot loader. So unless your code addresses the boot loader region, you should be safe then. Also there is no way to inject code like in PC because of the Harvard Architecture. – Kwasmich Aug 11 '20 at 11:27
1
  1. the bootloader doens't listen on RX/TX3.
  2. to start the bootloader reset is required
  3. to communicate with the bootloader a serial programmer must have STK500 protocol or a telnet bridge for avrdude, which your NodeMCU sketch doesn't have

If your NodeMCU sketch has OTA, then the sketch could be updated to an avrdude telnet bridge. then reset would be needed to activate the bootloader. If your NodeMCU doesn't have a wire to Mega reset pin or you don't have a command in your Mega sketch to activate the reset, some serial overload of your Mega sketch could be a way.

But all this doesn't have an effect because the bootloader only listens at RX0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.