UAiRT - Over The Air UART

The talk is a stand-in presentation for an open-source wireless implant project that targets a router's UART debug interface. The presenter argues that a microcontroller costing a few dollars, soldered inside a router, can sit outside the reach of firewalls and network monitoring. Power can come from the router's own rails or from a small lithium cell salvaged from a disposable vape.

The middle of the talk covers the access paths and the scripting engine. The implant offers a serial console over Bluetooth Low Energy, a Wi-Fi web interface with a raw TCP socket, and a connectionless ESP-NOW transport that uses vendor-specific action frames instead of beacons. Attack scripts are written in JSON, compiled to bytecode, and stored in flash so they run without a live connection. Demonstrated examples include repeatedly sending a key to catch a U-Boot interrupt window, a scripted login brute force, dumping a shadow file when a GPIO input goes high, and a timed voltage glitch during boot.

The closing section covers impact and defence. Practitioners would care about the detection options: physical inspection and X-ray at receiving, BLE service scanning, and Wireshark filters for ESP-NOW frames. The speaker also lists limits, including the need for one physical visit, per-target tuning of pinout, baud rate and boot timing, and the loss of wireless range inside shielded racks.