Security setting to disable flashing over USB

[JaneX8]

I would very much like to have a mechanism to disable firmware flashing over USB and I realize this can only be done in the printer firmware.

I'm using OctoPi which is, although only accessible in my home network, a network connected web interface that has a USB interface to the printer and does with the help of a plugin allow remote firmware flashing. From a security point of view, if somehow OctoPrint was hacked malicious firmware could be flashed remotely. While if USB flashing could be disabled on the printer itself, the risk disappears. As it would require physical access to the SD card.

The main reason I think remote flashing is such a risk is that like malicious firmware could be flashed that for example overheats the limits of the printer while not reporting the current temperatures to the display or serial port. This is an inherit fire safety risk and target for cyber attacks with potential physical damage.

With all current conflicts going on in the world, the increase in cyber attack and potentially misconfigured OctoPrint instances being exposed to the internet. This is a real risk that could be solved by simply having a setting that disables USB flashing.

[mriscoc]

You can disable USB firmware update by commenting out:

Ender3V2S1/Marlin/Configuration_adv.h

Lines 1902 to 1908 in 4f65c63

	// Add an optimized binary file transfer mode, initiated with 'M28 B1'
	#define BINARY_FILE_TRANSFER // MRiscoC Enabled for easy firmware upgrade
	#if ENABLED(BINARY_FILE_TRANSFER)
	// Include extra facilities (e.g., 'M20 F') supporting firmware upload via BINARY_FILE_TRANSFER
	#define CUSTOM_FIRMWARE_UPLOAD // MRiscoC Enabled for easy firmware upgrade
	#endif

[JaneX8]

Thank you. I will try to make a custom build. However, I think having this as an option in all builds simply in the settings menu will make it more accessible for everyone.

You could even consider disabling it by default for aforementioned security reasons.