ESP32 and ESP2866 devices are very famous as cheap IoT controller and connect via wireless LAN.

Unfortunately the firmware of these devices is still closed source and quite large. It is there any chance to detect, if malicious software is shipped in the firmware, which opens backdoors or harms the network?

1 Answer 1


Your question is similar to asking if there are any indicators that you can trust a person you've never seen before. The answer in this case is that there are no direct indicators and that you have to rely on the experiences of others with this person. This means in case of these controllers

  • Check the reputation of the company.
  • Check how much these products are used.
  • Check what experts (real experts, not claimed experts) say, i.e. if they recommend these products or not. Note that there might not only be a problem of explicit backdoors but also of bugs which might be used as a backdoor.
  • And, in times where the NSA and probably other government agencies are able to compromise everything you should also check the distributor and the parcel service, since you might get a version of the controller which was compromised on the way to you.

Of course, how much efforts you take in checking all these depends on your security needs. And this is again the same with the unknown person: if you just risk of loosing $10 when trusting this person you will not do much checks but if you risk of loosing $10.000.0000 you'll probably invest a larger sum in doing deeper background checks.

  • Are there tools which could run some standard tests on the firmware? Jun 16, 2017 at 20:22
  • 1
    @JonasStein: what standard tests? If there really is a malicious backdoor it is probably well hidden and will not be triggered in "standard tests". If the vendor thinks that you are important enough (i.e. lots of money involved) you might get access to the source code, see computerworld.com/article/2581562/security0/… Jun 16, 2017 at 21:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .