952
Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices.
(www.tarlogic.com)
Source Link Privacy.
Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.
Update: The ESP32 "backdoor" that wasn't.
This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.
But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.
Not sure this disclosure increases the risk any. I wouldn't start panicking.
So explained to me, a tech illiterate in comparison, this is China bad scaremongering?
'Backdoor' sounds malicious with intent.
The article is a security company trying to hype their company with a theoretical attack that currently has no hypothetical way to be abused
The article has an update now fixing the wording to "hidden feature" but, spoilers, every BT device has vendor specific commands.
The documentation of the part just wasn't complete and this companies "fuzzing" tool found some vendor commands that weren't in the data sheet
The China part just came from OP
The article is a security company ~~trying to hype their company~~ ruining their reputation in an incredibly ill-thought out attack that companies will ABSOLUTELY remember.
Even worse, it just makes this security company look incompetent. Like a home security company that announces a huge vulnerability in Schlage locks- there's a key that can unlock the lock included with every lock sold!!11!!!11!one!
I agree, but unfortunately, this has become common since Heartbleed, and they seem to be able to sell their snake oil to CTOs...
thank you