this post was submitted on 08 Mar 2025

927 points (93.8% liked)

Technology

64937 readers

4210 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

927

Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices. (www.tarlogic.com)

submitted 1 day ago* (last edited 7 hours ago) by [email protected] to c/[email protected]

173 comments fedilink hide all child comments

Source Link Privacy.

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

(page 2) 50 comments

sorted by: hot top controversial new old

[–] [email protected] 104 points 19 hours ago

I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.

[–] [email protected] 140 points 22 hours ago (4 children)

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[–] [email protected] 16 points 13 hours ago (1 children)

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

[–] [email protected] 3 points 13 hours ago (1 children)

thats a very fair point, I had not seen anyone else make this one But the problem is that in this case, this functionality was entirely undocumented. I dont think it was intended for programmers.

Now if the firmware was open source, people would have gotten to know about this much sooner even if not documented. Also such functionality should ideally be gated somehow through some auth mechanism.

Also just like how the linux kernel allows decades old devices to be at the very least patched for security risks, open firmware would allow users of this chip to patch it themselves for bugs, security issues.

[–] [email protected] 3 points 13 hours ago

Yeah, of course, it would be better in many ways if the firmware wasn't closed.

[–] [email protected] 23 points 16 hours ago (2 children)

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

[–] [email protected] 2 points 10 hours ago

This is about silicon. Undocumented instructions have just been found in it but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).

load more comments (1 replies)

[–] [email protected] 7 points 14 hours ago

Backdoored devices are useful for people who can impede that.

And the way EU is approaching privacy, surveillance and all such, - oh-hoh-ho, I don't think there will be a EU law.

[–] [email protected] 11 points 20 hours ago

Yeah tons of weird little private softwares never get updates, but they aren't making anyone money either

[–] [email protected] 201 points 1 day ago (1 children)

Well... Shit.

There are so, so, so, many ESP32's in not just my house, but practically everyone I know.

There outta be fines for this BS.

[–] [email protected] 154 points 1 day ago (18 children)

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.

[–] [email protected] 68 points 1 day ago (3 children)

You literally need physical access to the device to exploit it

You don't need physical access. Read the article. The researcher used physical USB to discover that the Bluetooth firmware has backdoors. It doesn't require physical access to exploit.

It's Bluetooth that's vulnerable.

https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/

[–] [email protected] 2 points 10 hours ago

[–] [email protected] 69 points 23 hours ago (5 children)

I just re-read the article and yes, you still need physical access.

The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.

load more comments (5 replies)

[–] [email protected] 30 points 23 hours ago

Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections.

I really wish these articles just tell us what these scenarios are. I understand companies need publicity or need to sell software but if it isn't replicatable and the article says "might be possible" it kind of sounds like a secuity sales pitch.

This is especially the case if an attacker already has root access, planted malware, or pushed a malicious update on the device that opens up low-level access.

This part basically sounds more like a software issue where the attacker has a way in already. The system is already vulernable at this point before using the exploit found.

I don't think there's enough information out yet.

It is very interesting though.

load more comments (17 replies)

[–] [email protected] 44 points 21 hours ago (13 children)

The other day someone posted in Canada community that Canada should stop using Tesla cars and import Chinese cars. I replied saying, “That’s like replacing one evil with another.” I was downvoted by a lot of people. I should’ve expected it cuz a lot of people have short term memory.

[–] [email protected] 28 points 19 hours ago (2 children)

Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.

For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.

[–] [email protected] 12 points 16 hours ago (2 children)

Europe and its 50 car makers could also be considered instead of China..

load more comments (2 replies)

[–] [email protected] 7 points 15 hours ago (5 children)

CCP has backdoor into every tech that comes out of China. It’s not about just privacy. They control democracies based on shaping narratives. They’ll utilize everything that democracy offers and use it against countries. They don’t have freedom of speech or press so they themselves are not victims of it. EVs are really just computers on the road. Flooding the market with Chinese EVs would just mean creating a massive free network on a foreign soil for them.

load more comments (5 replies)

[–] [email protected] 10 points 18 hours ago* (last edited 18 hours ago) (2 children)

A lot of people are dumb. Or maybe because they feel offended because they are Chinese, but the reality is that every Chinese company is ultimately controlled by the CCP. If I was fighting a cold war, I would do the same. Sell compromised devices to my trade partners (AKA enemies) so I have leverage when I need it.

[–] [email protected] 3 points 10 hours ago

Or maybe because they feel offended because they are Chinese

I'm Chinese-American and I'm not offended. The tankies from .ml are

load more comments (1 replies)

load more comments (11 replies)

[–] [email protected] 82 points 1 day ago (2 children)

Too much fanfare and too little real info shared to be of any value. Sounds more like an ad than infosec

[–] [email protected] 5 points 17 hours ago

Seriously wtf did I just try to read? It sounded like AI slop.

load more comments (1 replies)

[–] [email protected] 24 points 22 hours ago (12 children)

The Chinese adding back doors into their software/hardware.

Say it ain't so!

[–] [email protected] 8 points 14 hours ago (1 children)

It ain't so.

To use the "backdoor" an attacker needs to have full access to the esp32 powered device already.

It's like claiming that being able to leave your desk without locking your PC is a backdoor in your OS.

[–] [email protected] 2 points 9 hours ago

Yes, this is about undocumented instructions found in the silicon but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).

It is good to question the "backdoor" allegations - maybe the instructions' microcode was buggy and they didn't want to release it.

[–] [email protected] 22 points 22 hours ago

Say it ain't so
Your bug is a heartbleeder
Say it ain't so
My NIC is a bytetaker

load more comments (10 replies)

[–] [email protected] 43 points 1 day ago (7 children)

I’d like to know if this is just a firmware update or unfixable, but sadly this seems just an ad rather than news

load more comments (7 replies)

load more comments