2025-08-10 16:10 UTC
One of the exploits demonstrated is PKI poisoning, this is where we listen for a complete user profile and only change the public key to one we control.
In the case of mesh marauder we also add a little 🥷to the user name so people can see something is wrong.
If they never have seen this user before they will appear as a green contact.
If this is a contact they already knew the meshtastic app provides a warning but appears to replace the original key without user input.
Replies (1)
-
@nullagent@partyon.xyz 2025-08-10 16:19
The core issue to the above PKI poisoning attack is that NO core parts of meshtastics protocol is signed. The user profile transmits the public key and there is no way to verify any of the information in it was even sent by that included public key 🙄 Nothing is signed and simply setting someone else's MAC address in the unencrypted header makes you that user.