Buttonless DFU Example broken

[parco]

Hi there,

I know you guys are very busy and I appreciate your quick response on Devzone.

I'd like to make a request for a more polished example of Buttonless DFU using SDK 12.1 with nRF52.

We are nearing production and if there's anything I'd like to get in concrete, it's a reliable way to upgrade firmware in the field.

The current example is not working out of the box, and the documentation doesn't offer a complete start to finish of how to upgrade. For example, what should we do after we send a 0x01 to the characteristic?

Thanks, Paul

[pmeilleur]

I'm interested by the topic and I guess I'm not the only one! Can you please share the developments with the community..?

[sam wagner]

hi Hung,

Since the without sharing the bonding information between App and the Bootloader, the OTA DFU happens on an unencrypted link. So, anybody can look at the ECDSA signed FW image being transferred and possibly reverse engineer the image (since the FW itself is not encrypted) and/or do replay attack of the same ECDSA signed FW image. (some references: devzone.nordicsemi.com/.../). How does the current method of DFU guard against the above issues (namely, reverse engineering of FW image sniffer on air and replay attack of the same image along with its ECDSA signature)?

Thanks, Sarang