Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
sw-bluetooth-dfu
Advanced tools
Update device firmware via Nordic's DFU protocols using Web Bluetooth.
Since version 12 of Nordic's SDK, the device firmware update protocol has changed to be made secure. The protocol can be seen here:
Earlier protocols were insecure, so it is recommended to use the secure protocol version in this package.
This repo has a live web example of the secure DFU. Open this site in a Web Bluetooth enabled browser:
https://thegecko.github.io/web-bluetooth-dfu/
Node.js > v8.14.0, which includes npm
.
The package is distributed using npm. To install the package in your project:
$ npm install web-bluetooth-dfu
You will need a Nordic nRF51822, nRF52832 or nRF52840 development kit running the latest softdevice. Secure DFU supports softdevices from S130.
Softdevices can be found on Nordic's site:
Upon flashing the device will be in bootloader mode and ready to receive a DFU transfer.
Example packages to update can be found in the firmware folder.
An excellent article exists with a walkthrough of using the device firmware update here:
https://devzone.nordicsemi.com/blogs/1085/getting-started-with-nordics-secure-dfu-bootloader/
tl;dr
J-LINK Interface Firmware
Download / Install
$ pip install nrfutil
Flashing SoftDevice
$ nrfjprog --family NRF52 --eraseall
$ nrfjprog --family NRF52 --program <softdevice.hex> --sectorerase --reset
Using Test DFU Bootloader
$ nrfjprog --family NRF52 --program <bootloader.hex> --sectoranduicrerase --reset
Signing Keys
$ nrfutil keys generate private.key
$ nrfutil keys display --key pk --format code private.key --out_file dfu_public_key.c
Developing an Application
gcc
, linux is easiest$ nrfjprog --family NRF52 --program <bootloader.hex> --sectoranduicrerase --reset
Building DFU Package
Refer to this document:
e.g.:
$ nrfutil pkg generate --debug-mode --application <your_app.hex> --key-file private.key dfu_app.zip
FAQs
Device firmware update with Web Bluetooth
The npm package sw-bluetooth-dfu receives a total of 5 weekly downloads. As such, sw-bluetooth-dfu popularity was classified as not popular.
We found that sw-bluetooth-dfu demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.