981
submitted 1 day ago* (last edited 13 hours ago) by Tea@programming.dev to c/technology@lemmy.world

Source Link Privacy.Privacy test result

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

(page 2) 50 comments
sorted by: hot top controversial new old
[-] notanapple@lemm.ee 140 points 1 day ago

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[-] secret300@lemmy.sdf.org 23 points 22 hours ago

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

[-] ChaoticNeutralCzech@feddit.org 2 points 16 hours ago

This is about silicon. Undocumented instructions have just been found in it but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).

load more comments (1 replies)
[-] unemployedclaquer@sopuli.xyz 11 points 1 day ago

Yeah tons of weird little private softwares never get updates, but they aren't making anyone money either

load more comments (3 replies)
[-] Ebby@lemmy.ssba.com 198 points 1 day ago

Well... Shit.

There are so, so, so, many ESP32's in not just my house, but practically everyone I know.

There outta be fines for this BS.

[-] cogman@lemmy.world 165 points 1 day ago

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.

[-] Blue_Morpho@lemmy.world 76 points 1 day ago

You literally need physical access to the device to exploit it

You don't need physical access. Read the article. The researcher used physical USB to discover that the Bluetooth firmware has backdoors. It doesn't require physical access to exploit.

It's Bluetooth that's vulnerable.

https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/

[-] cogman@lemmy.world 71 points 1 day ago

I just re-read the article and yes, you still need physical access.

The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.

[-] Blue_Morpho@lemmy.world 21 points 1 day ago

"Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections."

I of course don't know details but I'm basing my post on that sentence. "Backdoor may be possible via ... rogue Bluetooth connections."

[-] haleywm@startrek.website 70 points 1 day ago

Looking at the article, the exploit requires you to be able to send arbitrary data to the Bluetooth device over a physical connection. This means that a properly secure application will be protected from drive by connections, but if the application has an exploit that either lets an attacker write arbitrary values to the Bluetooth controller, or more likely contains a general arbitrary code execution exploit, then you could use this to rewrite values to the chip that would let you "persist" certain changes to the Bluetooth chip that would be difficult to notice.

I would consider this a moderate concern, as this will definitely increase your options if you're looking to be able to make an attack that targets a specific device and this gives you a few additional persistence options, but any attack would have to be designed for a particular program running connected to a Bluetooth chip.

A more likely concern in my opinion would be the possibility of a supply chain attack, where someone compromises a Bluetooth chip that they know will be used to construct a particular part.

I don't think that it's super likely that either of these will affect the average person, only corporations and governments where espionage is an actual threat, as if you can find a Bluetooth IOT device that you want to mess with, like a Bluetooth enabled door lock, then you're more likely to be able to find an arbitrary code execution attack which causes it to unlock immediately. Being able to spoof a different Bluetooth device isn't likely to give you that big of an advantage when you're working with a device that was already vulnerable for a different reason.

load more comments (3 replies)
[-] ChaoticNeutralCzech@feddit.org 2 points 16 hours ago

This is about silicon. Undocumented instructions have just been found in it but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).

[-] IllNess@infosec.pub 29 points 1 day ago

Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections.

I really wish these articles just tell us what these scenarios are. I understand companies need publicity or need to sell software but if it isn't replicatable and the article says "might be possible" it kind of sounds like a secuity sales pitch.

This is especially the case if an attacker already has root access, planted malware, or pushed a malicious update on the device that opens up low-level access.

This part basically sounds more like a software issue where the attacker has a way in already. The system is already vulernable at this point before using the exploit found.

I don't think there's enough information out yet.

It is very interesting though.

load more comments (17 replies)
[-] NightCrawlerProMax@lemmy.world 59 points 1 day ago

The other day someone posted in Canada community that Canada should stop using Tesla cars and import Chinese cars. I replied saying, “That’s like replacing one evil with another.” I was downvoted by a lot of people. I should’ve expected it cuz a lot of people have short term memory.

[-] matlag@sh.itjust.works 28 points 1 day ago

Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.

For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.

[-] themurphy@lemmy.ml 12 points 22 hours ago

Europe and its 50 car makers could also be considered instead of China..

load more comments (2 replies)
[-] NightCrawlerProMax@lemmy.world 9 points 21 hours ago

CCP has backdoor into every tech that comes out of China. It’s not about just privacy. They control democracies based on shaping narratives. They’ll utilize everything that democracy offers and use it against countries. They don’t have freedom of speech or press so they themselves are not victims of it. EVs are really just computers on the road. Flooding the market with Chinese EVs would just mean creating a massive free network on a foreign soil for them.

[-] Malfeasant@lemm.ee 1 points 11 hours ago

All cars are computers on the road at this point, not just EVs...

load more comments (1 replies)
[-] matlag@sh.itjust.works 1 points 12 hours ago

Summary: China is not a friend country. It's a hostile country. Yes, we know.

But the news is... so is the USA to Canada now. A hostile country threatening to annex Canada and trying to cripple the economy as a way to achieve the goal. So either we slap 100% tariffs on US made cars, which would hurt Canadians, or we apply the same tariffs on Chinese cars, so reduce them from where they are at the moment.

load more comments (1 replies)
[-] freely1333@reddthat.com 4 points 18 hours ago

As opposed to the teslas with the back doors for the us government… but will be moot when Canada is part of the states anyway

[-] Montreal_Metro@lemmy.ca 13 points 1 day ago* (last edited 1 day ago)

A lot of people are dumb. Or maybe because they feel offended because they are Chinese, but the reality is that every Chinese company is ultimately controlled by the CCP. If I was fighting a cold war, I would do the same. Sell compromised devices to my trade partners (AKA enemies) so I have leverage when I need it.

Or maybe because they feel offended because they are Chinese

I'm Chinese-American and I'm not offended. The tankies from .ml are

[-] digdilem@lemmy.ml 6 points 22 hours ago

the reality is that every Chinese company is ultimately controlled by the CCP.

Yes.

But in the same way that every US company is ultimately controlled by the US Government. And every EU company by them. And every other country by their own government.

[-] Subdivide6857@midwest.social 10 points 1 day ago

“China bad” because western media says so. Please disregard the billions of dollars spent by western governments to ensure you keep thinking that way.

It’s just another capitalistic country no better or worse than Canada or the USA. Though, the Chinese government has said their intention is to move towards socialism, so good for them. I’m stuck over here witnessing fascist billionaires loot the government/working class.

[-] thann@lemmy.dbzer0.com 15 points 22 hours ago

Thats super interesting! Write a poem about three gorges dam please

[-] NoSpotOfGround@lemmy.world 14 points 22 hours ago

Well, no, China is bad because freedom is very restricted there and because they have ambitions to dominate the world.

Yes, every other world power in the world is more or less the same. People cannot, in general, be trusted to be "good" when given the opportunity to abuse. A world power can be held in check by the presence and efforts of other world powers, though.

load more comments (2 replies)
[-] norevolutionsontv@lemm.ee 6 points 21 hours ago* (last edited 21 hours ago)

Everyone has short-term memory and long-term memory. You're misunderstanding precisely what "short-term memory" refers to. Short-term memory is held for a short time before it's converted to long-term memory. What you're referring to is being short-sighted. As in people who don't fully think about the long-term consequences of current actions. Said short-sighted people still have both short and long-term memory. They're probably just a little dumb so they don't fully utilize the memories stored long-term.

load more comments (1 replies)
load more comments (1 replies)
[-] Oisteink@feddit.nl 82 points 1 day ago

Too much fanfare and too little real info shared to be of any value. Sounds more like an ad than infosec

load more comments (2 replies)
[-] RmDebArc_5@sh.itjust.works 40 points 1 day ago

I’d like to know if this is just a firmware update or unfixable, but sadly this seems just an ad rather than news

[-] ChaoticNeutralCzech@feddit.org 2 points 14 hours ago

There is nothing to "fix". Undocumented instructions have just been found in the silicon but they are not executable unless the ESP32's firmware their owner flashed to give it a purpose uses them. No pre-2025 firmware that we know of uses these instructions, and they might turn out to be buggy so compilers might not adopt them. If they turn out OK, the documentation of the instruction set will need an update, and compilers will be able to take advantage of the new instructions.

[-] badlotus@discuss.online 26 points 1 day ago* (last edited 1 day ago)

Here’s an article with a bit more detail… but I’m still unclear whether these backdoor commands are hardware circuits or firmware logic.

Bleeping Computer: Undocumented "backdoor" found in Bluetooth chip used by a billion devices

load more comments (3 replies)
load more comments (2 replies)
[-] RememberTheApollo_@lemmy.world 13 points 1 day ago

I couldn’t find a list of devices. Anyone else find one?

[-] embed_me@programming.dev 16 points 1 day ago

The article is talking about the Espressif ESP32 micro controller (has Wi-Fi/Classic Bluetooth/BLE).

I don't know if the variants of this chip also have the same vulnerability (my guess is yes). As someone who works on this chip, I'm interested in more discourse on this matter.

load more comments (8 replies)
load more comments (5 replies)
load more comments
view more: ‹ prev next ›
this post was submitted on 08 Mar 2025
981 points (100.0% liked)

Technology

64937 readers
3628 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS