this post was submitted on 08 Mar 2025

953 points (93.7% liked)

Technology

64933 readers

3979 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

953

Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices. (www.tarlogic.com)

submitted 1 day ago* (last edited 16 hours ago) by Tea to c/[email protected]

166 comments fedilink hide all child comments

Source Link Privacy.

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 8 points 9 hours ago

Does anyone know where it is that we can find these new commands? I have an esp32 dev kit just a few feet away from me as i read this. It might be interesting to know what these new product "features" are.

[–] [email protected] 15 points 13 hours ago

The rebuttal wasn't as comforting as some are making it out to be. They seem to be more interested in the semantics of it not being a backdoor tied to a specific product, which appears to be true.

Rather it is a potential for vulnerability that exists in all wireless implementation, which seems to me to be a bigger issue.

[–] [email protected] 34 points 16 hours ago (1 children)

This isn't a backdoor. Just a company trying to make name for themselves by sensationalizing a much smaller discovery.

[–] [email protected] 22 points 13 hours ago (1 children)

Seriously this. Every single IC which has digital logic contains some number of undocumented test commands used to ensure it meets all the required specifications during production. They're not intended to be used for normal operation and almost never included in datasheets.

[–] [email protected] 11 points 13 hours ago* (last edited 13 hours ago)

If anyone's ever followed console emulator development, they know those undocumented commands are everywhere. There's still people finding new ones for the N64 hardware

Edit: I should say undocumented behavior, not necessarily new commands

[–] [email protected] 28 points 16 hours ago (4 children)

Please update the title of this post to mention the update

load more comments (4 replies)

[–] [email protected] 2 points 9 hours ago

Haha. I wear cheap Chinese bluetooth literally on my skull like 95% of the time, web when sleeping.

Hope they enjoy my thoughts.

[–] [email protected] 35 points 19 hours ago (1 children)

Weird that they removed the reference to ESP32, one of the most common and widely known microcontrollers, from the headline.

[–] [email protected] 2 points 5 hours ago

It’s because the security company basically lied about this being a vulnerability, and probably opened themselves up to a lawsuit.

[–] [email protected] 13 points 16 hours ago (1 children)

Gotta blame China to get upvoted on Lemmy.

[–] Tja 8 points 13 hours ago

Or use a precise title. It's not a backdoor or a "backdoor".

[–] [email protected] 21 points 18 hours ago (3 children)

Fukin dmnit! I just spent the last several months fine tuning a PCB design supporting this platform. I have , what i believe to be my last iteration, being sent to fab now. I have to look i to this. My solution isnt using bluetooth, so i dont know if im vulnerable.

[–] [email protected] 4 points 9 hours ago

Go for it. It’s a bullshit attention grab. No backdoor, just some undocumented vendor commands (which is the norm for virtually every chip out there).

[–] mousetail 5 points 11 hours ago

The exploit requires physical access. It's not exploitable in 99% of cases

[–] [email protected] 12 points 16 hours ago* (last edited 16 hours ago)

Its not a backdoor, you're most likely fine.

[–] [email protected] 77 points 1 day ago (1 children)

This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.

But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.

Not sure this disclosure increases the risk any. I wouldn't start panicking.

[–] [email protected] 7 points 20 hours ago (1 children)

So explained to me, a tech illiterate in comparison, this is China bad scaremongering?
'Backdoor' sounds malicious with intent.

[–] [email protected] 14 points 18 hours ago* (last edited 17 hours ago) (2 children)

The article is a security company trying to hype their company with a theoretical attack that currently has no hypothetical way to be abused

The article has an update now fixing the wording to "hidden feature" but, spoilers, every BT device has vendor specific commands.

The documentation of the part just wasn't complete and this companies "fuzzing" tool found some vendor commands that weren't in the data sheet

The China part just came from OP

[–] [email protected] 3 points 13 hours ago (1 children)

The article is a security company ~~trying to hype their company~~ ruining their reputation in an incredibly ill-thought out attack that companies will ABSOLUTELY remember.

Even worse, it just makes this security company look incompetent. Like a home security company that announces a huge vulnerability in Schlage locks- there's a key that can unlock the lock included with every lock sold!!11!!!11!one!

[–] [email protected] 2 points 12 hours ago

I agree, but unfortunately, this has become common since Heartbleed, and they seem to be able to sell their snake oil to CTOs...

[–] [email protected] 3 points 17 hours ago

thank you

[–] [email protected] 106 points 1 day ago

I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.

[–] [email protected] 142 points 1 day ago (4 children)

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[–] [email protected] 16 points 23 hours ago (2 children)

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

load more comments (2 replies)

[–] [email protected] 24 points 1 day ago (2 children)

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

[–] [email protected] 5 points 15 hours ago

But then big companies wouldn't be able to keep milking the consumer via planned obsolescence. Won't somebody think of the shareholders?

load more comments (1 replies)

load more comments (2 replies)

[–] [email protected] 7 points 20 hours ago* (last edited 8 hours ago) (4 children)

This turned racist / xenophobic real quickly.

There have been several other posts about this without mentioning China at all, especially in the post itself.

No where in the article does it say "chinese", literally anywhere.

Check your racism.

Edited to remove where I stated it was manufactured. I did a quick search and found a couple mentions, but did not thoroughly check sourced. Apologies.

[–] [email protected] 29 points 17 hours ago* (last edited 17 hours ago) (3 children)

I agree we shouldn't be racist against Chinese people, but you're ignorant. From wikipedia: ESP32 is created and developed by Espressif Systems, a Chinese company based in Shanghai, and is manufactured by TSMC using their 40 nm process.It is a successor to the ESP8266 microcontroller.

So it's designed/developed in China and manufactured in Taiwan; not China.

load more comments (3 replies)

[–] Tea 8 points 19 hours ago* (last edited 19 hours ago) (4 children)

I actually wanted to keep the title short, but I think it would be better to edit the title to avoid any confusion to make it clear that it's manufactured in China, rather than saying it in the current way.

Edit: I edited the title to reflect the details better.

load more comments (4 replies)

load more comments (2 replies)

[–] [email protected] 204 points 1 day ago (1 children)

Well... Shit.

There are so, so, so, many ESP32's in not just my house, but practically everyone I know.

There outta be fines for this BS.

[–] [email protected] 156 points 1 day ago (26 children)

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.

load more comments (26 replies)

load more comments