Final Firmware Analysis Report: RTK Surveyor Firmware v3.10

---

1) Executive Summary & Overall Risk Rating

Summary:
The RTK Surveyor ESP32 firmware image (v3.10) is an ESP-IDF/Arduino-based application with embedded gzip-compressed web assets in a LittleFS filesystem. Analysis uncovered multiple embedded components including mbedTLS, lwIP, and ESP HTTP server features. Critically, embedded PEM-format certificates exist but no parseable private keys were extracted from filesystem assets. The firmware supports OTA updates via JSON/BIN fetching with a forced update feature and contains HTTP upload endpoints secured by Basic Auth, with evidence of usage of development tokens and various cloud integration tokens.

Risk Rating: High due to:

• Presence of forced OTA update mechanism without clear cryptographic signature verification
• Embedded development tokens and token handling patterns
• HTTP file upload endpoints secured only with Basic auth (possible weak authentication)
• Use of legacy or vulnerable third-party components (esp-idf v4.4-beta1, mbedTLS, lwIP) with known CVEs
• Embedded root CA certs reduce risk but the absence of private key leakage is a positive sign

Immediate remediation on OTA update verification and token management is advised. Further investigation of the firmware update and authentication logic is critical.

---

2) Firmware Metadata

---

3) Key Findings

Embedded Certificates/Keys

• Detected -----BEGIN CERTIFICATE----- PEM blocks embedded in firmware (Amazon Root CA 1 and others).
• PEM private key markers present as strings but actual extracted .pem files are empty and no parsed private keys found.
• DER-like certificate data embedded inside gzipped font assets (e.g., icomoon.ttf.gz) indicating embedded root CAs.

OTA Behavior

• Firmware fetches remote JSON manifests and BIN payloads from GitHub URLs for OTA updates:
  • https://raw.githubusercontent.com/sparkfun/SparkFun_RTK_Firmware_Binaries/main/RTK-Firmware.json
  • RTK_Surveyor_Firmware_Force.bin forced update mechanism active.
• Absence of strings indicating cryptographic signature verification of updates (only checksum and HTTPS).
• Forced update mechanism can apply firmware without obvious interactive user approval.

Web Endpoints

• HTTP server running with exposed endpoints including /upload, /listfiles, /file.
• Basic authentication present (Authorization: Basic %s, Basic realm="Login Required").
• Firmware upload and file upload handlers likely exist (firmwareUploadStatus, FileManager Upload1/2/3).

Development Tokens & Credentials

• Strings indicate usage of development tokens (Warning: Using the development token!).
• Tokens and credentials managed via variables: pointPerfectDeviceProfileToken, pointPerfectCurrentKey, PointPerfect tokens.
• Basic HTTP auth credentials potentially stored or entered; NTRIP and Thingstream API credentials referenced.

Other Components Detected

• ESP-IDF v4.4-beta1 identified from embedded version strings.
• mbedTLS for TLS and cryptographic operations.
• lwIP TCP/IP stack.
• ESP HTTP Server handling web UI and uploads.
• Arduino core libraries (esp32 2.0.2 toolchain).

---

4) IOCs and Evidence

---

5) Vulnerability Mapping Summary

Components Detected & CVE Classes (Guidance)

Note: Exact CVE IDs require querying external CVE/NVD databases with component version details. Recommendations include allowing network access for scanning or manual CVE lookups based on ESP-IDF version strings.

---

6) Prioritized Remediation and Mitigation Steps

---

7) Recommended Next Steps & Optional Deeper Analyses

• DER carving for embedded certificates: Advanced binary carving from gzip font assets to extract DER-formatted certificates and convert to PEM for full parsing.
• Ghidra decompilation: Open/continue using the existing Ghidra project for the firmware to decompile OTA handler functions and HTTP upload endpoint handlers for detailed source logic and cryptographic verification controls.
• Firmware emulation: Deploy firmware in an ESP32 emulator to dynamically test OTA update flows, authentication enforcement, and endpoint behavior.
• CVE database query: When allowed, query NVD or OSS advisory feeds for exact CVE matching based on ESP-IDF version, mbedTLS, lwIP, and Arduino core versions used.
• Binary carve and extract: Further filename-based or signature-carving of gzip and PEM blobs to recover potentially hidden keys or manifests.

---

8) Attachments: Paths to Collected Logs and Extracted Artifacts

• Extracted files and logs: /sandbox/RTK_Surveyor_extracted/*
• Key logs:
  • Dynamic analysis log: /sandbox/RTK_Surveyor_extracted/dynamic_analysis_log.txt
  • Binwalk output: /sandbox/RTK_Surveyor_extracted/binwalk_output.txt
  • Firmware hashes file: /sandbox/RTK_Surveyor_extracted/hashes.txt
  • Extracted gzip assets directory: /sandbox/RTK_Surveyor_extracted/_RTK_Surveyor_Firmware_v3_10.bin.extracted/
  • Empty PEM files (potential key containers): /sandbox/_sandbox_RTK_Surveyor_extracted_pem_0001_.pem, /sandbox/_sandbox_RTK_Surveyor_extracted_pem_0002_.pem, /sandbox/_sandbox_RTK_Surveyor_extracted_pem_0003_.pem
• Ghidra project information is present in workspace (refer to project directory if deeper static analysis required).

---

JSON Summary

{
  "executive_summary": {
    "risk_rating": "High",
    "summary": "RTK Surveyor ESP32 firmware contains embedded gzip assets, certificates without parseable private keys, forced OTA updates with no clear signature verification, Basic auth web uploads, and embedded development tokens."
  },
  "firmware_metadata": {
    "file_name": "/sandbox/RTK_Surveyor_Firmware_v3_10.bin",
    "file_type": "ESP32 ESP-IDF/Arduino firmware image",
    "file_size_bytes": 2269328,
    "md5": "e05dd11e30b8cda365f64b990a3f21b7",
    "sha1": "c563edcf7f23d3f7718bee323cf21124c689df26",
    "sha256": "751e5bbce97e650b16e5c09dd1f10787c1fd9a630f115daee6d101fabff8ca66",
    "entropy_bits_per_byte": 6.1
  },
  "key_findings": {
    "embedded_certificates": ["Amazon Root CA 1", "GlobalSign Root CA inside gzipped font assets"],
    "embedded_private_keys": "No parseable PEM private keys found in extracted files",
    "ota_behavior": "OTA update by fetching JSON/BIN from GitHub; forced update present; no clear signature verification",
    "web_endpoints": ["/upload", "/listfiles", "/file"],
    "development_tokens": [
      "Warning: Using the development token!",
      "pointPerfectDeviceProfileToken / Keys stored"
    ],
    "components_detected": [
      "ESP-IDF v4.4-beta1",
      "Arduino ESP32 core 2.0.2",
      "mbedTLS",
      "lwIP",
      "ESP HTTP Server"
    ]
  },
  "iocs_and_evidence": {
    "firmware_path": "/sandbox/RTK_Surveyor_Firmware_v3_10.bin",
    "extracted_gzip_assets": "/sandbox/RTK_Surveyor_extracted/_RTK_Surveyor_Firmware_v3_10.bin.extracted/icomoon.ttf.gz",
    "pem_offsets": ["0x00059315", "0x00059352", "0x0005938b", "0x0005a702"],
    "http_basic_auth_strings": ["Authorization: Basic %s", "Basic realm=\"Login Required\""],
    "ota_urls": [
      "https://raw.githubusercontent.com/sparkfun/SparkFun_RTK_Firmware_Binaries/main/RTK-Firmware.json"
    ],
    "logs": {
      "dynamic_analysis_log": "/sandbox/RTK_Surveyor_extracted/dynamic_analysis_log.txt",
      "binwalk_output": "/sandbox/RTK_Surveyor_extracted/binwalk_output.txt",
      "hashes": "/sandbox/RTK_Surveyor_extracted/hashes.txt"
    }
  },
  "vulnerability_mapping_summary": {
    "esp_idf_v4_4": "Authentication bypass, buffer overflow, access control flaws; map via esp-idf 4.4 CVEs in NVD",
    "mbedtls": "X.509 parsing, TLS weaknesses; map mbedTLS CVEs for embedded ESP-IDF version",
    "lwip": "Packet parsing and DoS vulnerabilities; check lwIP CVEs for bundled version",
    "esp_http_server": "Directory traversal, auth bypass in upload endpoints; search esp_http_server CVEs"
  },
  "prioritized_remediation": {
    "immediate": [
      "Audit and restrict OTA forced update without signature verification",
      "Remove development tokens and rotate credentials",
      "Enforce TLS and strong auth on web UI and file upload endpoints"
    ],
    "short_term": [
      "Map third-party dependencies and patch known CVEs",
      "Harden upload handlers with validation",
      "Monitor OTA/upload attempts"
    ],
    "mid_term": [
      "Implement secure boot and cryptographic firmware verification",
      "Adopt unique device provisioning without embedded dev tokens",
      "Automate dependency security scanning"
    ],
    "long_term": [
      "Design signed firmware manifests with enforced on-device verification",
      "Periodic security audits and penetration testing"
    ]
  },
  "recommended_next_steps": [
    "Perform DER carving and PEM extraction from compressed assets",
    "Decompile and analyze OTA and upload handlers via Ghidra",
    "Emulate firmware to test authentication and update flows dynamically",
    "Query external CVE/NVD databases for exact component vulnerabilities (if internet access permitted)"
  ],
  "attachments": {
    "extracted_logs_and_files": "/sandbox/RTK_Surveyor_extracted/*",
    "dynamic_analysis_log": "/sandbox/RTK_Surveyor_extracted/dynamic_analysis_log.txt",
    "binwalk_output": "/sandbox/RTK_Surveyor_extracted/binwalk_output.txt",
    "hashes": "/sandbox/RTK_Surveyor_extracted/hashes.txt",
    "pem_files": [
      "/sandbox/_sandbox_RTK_Surveyor_extracted_pem_0001_.pem",
      "/sandbox/_sandbox_RTK_Surveyor_extracted_pem_0002_.pem",
      "/sandbox/_sandbox_RTK_Surveyor_extracted_pem_0003_.pem"
    ],
    "gzip_assets_directory": "/sandbox/RTK_Surveyor_extracted/_RTK_Surveyor_Firmware_v3_10.bin.extracted/",
    "ghidra_project_info": "Present in workspace"
  }
}

---

Summary

This firmware contains a complex embedded application with modern TLS, OTA features, and web management interfaces. The critical security risks stem primarily from unchecked OTA firmware authenticity and embedded development tokens, alongside potentially vulnerable third-party components. Immediate action to improve authentication, token hygiene, and OTA update validation is essential before production deployment or exposure. Further detailed static and dynamic analysis is strongly advised to confirm these findings and harden device security posture.*