Andrew Boyson / web

Common stuff for all my devices' web server pages: css, login, log, ipv4, ipv6, firmware update, clock, reset info etc.

Dependents:   oldheating gps motorhome heating

Security

A password has to be set whenever there has been a software reset. Resets following faults or power on do not require a new password as the hash is restored from the RTC GPREG register.

The password is not saved on the device; instead a 32 bit hash of the password is saved. It would take 2^31 attempts to brute force the password: this could be done in under a month if an attempt were possible every millisecond. To prevent this a 200 ms delay is introduced in the reply to the login form, that gives a more reasonable 13 years to brute force the password.

Once the password is accepted a random session id is created. This is 36 bit to give six base 64 characters but without an extra delay. If an attempt could be made every ms then this would still take over a year to brute force.

The most likely attack would to use a dictionary with, say, 10 million entries against the password which would still take 20 days to do.

firmware/http-firmware-script.js@47:cf7d4c34158e, 2019-02-27 (annotated)

Committer:
andrewboyson
Date:
Wed Feb 27 18:58:23 2019 +0000
Revision:
47:cf7d4c34158e
Parent:
46:1822fdbe6c0c
Child:
48:4e678727c4c9
Updated firmware module

Who changed what in which revision?

UserRevisionLine numberNew contents of line
andrewboyson 46:1822fdbe6c0c 1 var xhr;
andrewboyson 46:1822fdbe6c0c 2 function xhrOnLoad()
andrewboyson 46:1822fdbe6c0c 3 {
andrewboyson 46:1822fdbe6c0c 4 if (xhr.status == 200) document.getElementById('result').innerHTML = xhr.responseText;
andrewboyson 46:1822fdbe6c0c 5 else document.getElementById('result').innerHTML = 'Upload failed';
andrewboyson 46:1822fdbe6c0c 6 }
andrewboyson 46:1822fdbe6c0c 7 function xhrOnError()
andrewboyson 46:1822fdbe6c0c 8 {
andrewboyson 46:1822fdbe6c0c 9 document.getElementById('result').innerHTML = 'Upload error';
andrewboyson 46:1822fdbe6c0c 10 }
andrewboyson 46:1822fdbe6c0c 11
andrewboyson 46:1822fdbe6c0c 12 function startUpload()
andrewboyson 46:1822fdbe6c0c 13 {
andrewboyson 46:1822fdbe6c0c 14 var fileInput = document.getElementById('fileInput');
andrewboyson 46:1822fdbe6c0c 15
andrewboyson 46:1822fdbe6c0c 16 if (fileInput.files.length == 0)
andrewboyson 46:1822fdbe6c0c 17 {
andrewboyson 46:1822fdbe6c0c 18 document.getElementById('result').innerHTML = 'Please choose a file';
andrewboyson 46:1822fdbe6c0c 19 return;
andrewboyson 46:1822fdbe6c0c 20 }
andrewboyson 46:1822fdbe6c0c 21
andrewboyson 46:1822fdbe6c0c 22 if (fileInput.files.length > 1)
andrewboyson 46:1822fdbe6c0c 23 {
andrewboyson 46:1822fdbe6c0c 24 document.getElementById('result').innerHTML = 'Please choose just one file';
andrewboyson 46:1822fdbe6c0c 25 return;
andrewboyson 46:1822fdbe6c0c 26 }
andrewboyson 46:1822fdbe6c0c 27
andrewboyson 47:cf7d4c34158e 28 document.getElementById('result').innerHTML = 'Uploading...';
andrewboyson 47:cf7d4c34158e 29
andrewboyson 46:1822fdbe6c0c 30 xhr = new XMLHttpRequest();
andrewboyson 46:1822fdbe6c0c 31
andrewboyson 46:1822fdbe6c0c 32 xhr.onload = xhrOnLoad;
andrewboyson 46:1822fdbe6c0c 33 xhr.onerror = xhrOnError;
andrewboyson 47:cf7d4c34158e 34
andrewboyson 47:cf7d4c34158e 35 xhr.open('POST', '/firmware-ajax?filename=' + fileInput.files[0].name, true);
andrewboyson 46:1822fdbe6c0c 36 xhr.send(fileInput.files[0]);
andrewboyson 46:1822fdbe6c0c 37 }