Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make Colibri UI and firmware downloads/updates secure #198

Open
seppestas opened this issue Aug 15, 2017 · 0 comments
Open

Make Colibri UI and firmware downloads/updates secure #198

seppestas opened this issue Aug 15, 2017 · 0 comments

Comments

@seppestas
Copy link

The download link in the installation instructions and the configuration for the update endpoints for both Colibri UI and the firmware use unsecured HTTP. This allows attackers to install compromised software images and firmware using e.g a man in the middle attack or DNS spoofing on unsecured networks.

At the very least HTTPS should be used to download these files to prevent a botnet of 3D printers. Alternatively/additionally ckecksum could be calculated and placed in the wiki so people / the update mechanism can check the checksums match before copying the data on an SD card.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants