this post was submitted on 08 Mar 2025

949 points (93.6% liked)

Technology

64937 readers

4019 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

949

Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices. (www.tarlogic.com)

submitted 1 day ago* (last edited 15 hours ago) by [email protected] to c/[email protected]

171 comments fedilink hide all child comments

Source Link Privacy.

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 7 points 7 hours ago

Does anyone know where it is that we can find these new commands? I have an esp32 dev kit just a few feet away from me as i read this. It might be interesting to know what these new product "features" are.

[–] [email protected] 15 points 11 hours ago

The rebuttal wasn't as comforting as some are making it out to be. They seem to be more interested in the semantics of it not being a backdoor tied to a specific product, which appears to be true.

Rather it is a potential for vulnerability that exists in all wireless implementation, which seems to me to be a bigger issue.

[–] [email protected] 35 points 14 hours ago (1 children)

This isn't a backdoor. Just a company trying to make name for themselves by sensationalizing a much smaller discovery.

[–] [email protected] 23 points 12 hours ago (1 children)

Seriously this. Every single IC which has digital logic contains some number of undocumented test commands used to ensure it meets all the required specifications during production. They're not intended to be used for normal operation and almost never included in datasheets.

[–] [email protected] 11 points 11 hours ago* (last edited 11 hours ago)

If anyone's ever followed console emulator development, they know those undocumented commands are everywhere. There's still people finding new ones for the N64 hardware

Edit: I should say undocumented behavior, not necessarily new commands

[–] [email protected] 2 points 7 hours ago

Haha. I wear cheap Chinese bluetooth literally on my skull like 95% of the time, web when sleeping.

Hope they enjoy my thoughts.

[–] [email protected] 28 points 14 hours ago (4 children)

Please update the title of this post to mention the update

load more comments (4 replies)

[–] [email protected] 14 points 14 hours ago (1 children)

Gotta blame China to get upvoted on Lemmy.

[–] [email protected] 8 points 11 hours ago

Or use a precise title. It's not a backdoor or a "backdoor".

[–] jerkface 35 points 18 hours ago (1 children)

Weird that they removed the reference to ESP32, one of the most common and widely known microcontrollers, from the headline.

[–] [email protected] 2 points 4 hours ago

It’s because the security company basically lied about this being a vulnerability, and probably opened themselves up to a lawsuit.

[–] [email protected] 21 points 17 hours ago (3 children)

Fukin dmnit! I just spent the last several months fine tuning a PCB design supporting this platform. I have , what i believe to be my last iteration, being sent to fab now. I have to look i to this. My solution isnt using bluetooth, so i dont know if im vulnerable.

[–] [email protected] 4 points 8 hours ago

Go for it. It’s a bullshit attention grab. No backdoor, just some undocumented vendor commands (which is the norm for virtually every chip out there).

[–] [email protected] 5 points 10 hours ago

The exploit requires physical access. It's not exploitable in 99% of cases

[–] [email protected] 13 points 14 hours ago* (last edited 14 hours ago)

Its not a backdoor, you're most likely fine.

[–] [email protected] 78 points 23 hours ago

This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.

But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.

Not sure this disclosure increases the risk any. I wouldn't start panicking.

[–] [email protected] 108 points 1 day ago

I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.

[–] [email protected] 143 points 1 day ago (4 children)

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[–] [email protected] 16 points 21 hours ago (2 children)

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

load more comments (2 replies)

[–] [email protected] 24 points 1 day ago (2 children)

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

[–] [email protected] 5 points 13 hours ago

But then big companies wouldn't be able to keep milking the consumer via planned obsolescence. Won't somebody think of the shareholders?

load more comments (1 replies)

load more comments (2 replies)

[–] [email protected] 7 points 18 hours ago* (last edited 6 hours ago) (4 children)

This turned racist / xenophobic real quickly.

There have been several other posts about this without mentioning China at all, especially in the post itself.

No where in the article does it say "chinese", literally anywhere.

Check your racism.

Edited to remove where I stated it was manufactured. I did a quick search and found a couple mentions, but did not thoroughly check sourced. Apologies.

[–] [email protected] 29 points 16 hours ago* (last edited 16 hours ago) (3 children)

I agree we shouldn't be racist against Chinese people, but you're ignorant. From wikipedia: ESP32 is created and developed by Espressif Systems, a Chinese company based in Shanghai, and is manufactured by TSMC using their 40 nm process.It is a successor to the ESP8266 microcontroller.

So it's designed/developed in China and manufactured in Taiwan; not China.

load more comments (3 replies)

[–] [email protected] 7 points 18 hours ago* (last edited 18 hours ago) (4 children)

I actually wanted to keep the title short, but I think it would be better to edit the title to avoid any confusion to make it clear that it's manufactured in China, rather than saying it in the current way.

Edit: I edited the title to reflect the details better.

[–] [email protected] 1 points 12 hours ago

So instead of blatant racism based on a lie, you're just going to dogwhistle racism based on a lie.

load more comments (3 replies)

load more comments (2 replies)

[–] [email protected] 200 points 1 day ago (1 children)

Well... Shit.

There are so, so, so, many ESP32's in not just my house, but practically everyone I know.

There outta be fines for this BS.

[–] [email protected] 157 points 1 day ago (26 children)

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.

load more comments (26 replies)

load more comments