Skip to content

Best Practices

Recommended security posture for operating Espilon in authorized engagements and research. These practices protect your keys, your infrastructure, and the people within scope.

Authorized Use Only

Deploy Espilon only against devices and networks you own or are explicitly authorized in writing to test. Unauthorized use is illegal.

Keys

  • One key per device. Never reuse a master_key across devices; provisioning generates a fresh random key each time.
  • Protect keys.json. It holds every device's master key and is the credential for your whole fleet. Keep it on an encrypted disk with tight file permissions and back it up securely.
  • Rotate by re-provisioning. To rotate a device's key, re-provision it; this rewrites the fctry partition and the keystore entry.

Devices

  • Enable flash encryption for any device that could be physically captured. With the eFuse device key locked, a flash dump cannot reveal the plaintext master_key.
  • Disable UART logging in the field if boot logs could leak useful information.
  • Prefer the smallest capable chip for the task, and remember power-cycling returns a device to a clean hollow shell.

Operator host and network

  • Firewall port 2626. Bind the Management Protocol server to a controlled interface; expose a public address only when a remote agent (for example over GPRS) requires it.
  • Treat the operator host as sensitive. It compiles, signs, and stores keys; compromise of the host compromises the fleet.
  • Use HTTPS for OTA. Leave CONFIG_ESPILON_OTA_ALLOW_HTTP off outside the lab.

Modules

  • Review module source. Once loaded, a module has full hardware access on the agent. Only inject code you trust.
  • Avoid persistence unless required. Persisted modules survive a power cycle in encrypted NVS, which weakens the no-trace property. Leave CONFIG_ESPM_PERSIST_ENABLE off if you do not need it.
  • Stop cleanly. Use mod_stop / mod_purge to unload modules; their RAM is zeroed on unload.

Engagement hygiene

  • Keep written authorization and scope on hand for every deployment.
  • Stop disruptive operations (deauth, ARP poisoning, rogue DHCP) cleanly to restore the target environment.
  • Record what you deployed and where, and remove devices when the engagement ends.

See also