mirrors
/
Tasmota
mirror of https://github.com/arendst/Tasmota.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

clarify that MQTT and WLAN credential recovery is still possible on v6.0.0+

Nash Kaminski 2019-10-07 08:42:48 -05:00
parent 9390e691d4
commit c967c428dc
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Securing-your-IoT-from-hacking.org

@ -14,7 +14,7 @@ If someone is able to get your WLAN key, he can login into your network, if he i
(2)
If you can hack a SONOFF you might get access to the keys stored in the device. For example, the MQTT password allows you to read ALL of your devices and change any device at any time. With the information of the MQTT-Server user/password, it might be not required anymore to physically be in your WLAN. Maybe your MQTT Server is publicly accessible. Then the attacker can control your home from any place.
Update: 6.0.0: With this version passwords are not anymore exposed through the serial connection or through the webinterface in configuration mode. Therefore it is now not that simple to get the MQTT or WLAN password from a device. But maybe not impossible
Update: As of version 6.0.0 and later, passwords are not directly exposed through the serial connection or web interface in configuration mode. Therefore it is now less simple, *however still possible* to obtain the MQTT or WLAN password from a device. Such can be accomplished by downloading a configuration backup via the web UI of the device and decoding it using the decode-config.py script.
(3)
It might happen, that e.g. your Samsung SmartTV is not as secure as it should be and an attacker gets access to your network. Now he can listen to any traffic and maybe can make changes on all of your IoT devices.