this post was submitted on 08 Mar 2025
1029 points (92.8% liked)

Technology

66362 readers
4957 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 2 years ago
MODERATORS
 

Source Link Privacy.Privacy test result

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 4 points 4 days ago

Babe, wake up its time for your china fear mongering news

[–] [email protected] 2 points 4 days ago (1 children)

At this point I welcome them to come through.

[–] [email protected] 4 points 4 days ago (1 children)

Come through with what though?

[–] [email protected] 1 points 2 days ago

Idk what they can do with my data from my many Bluetooth devices so they are welcome to come through my Bluetooth devices 😂 and I'd be fine with being a Chinese citizen if that's where this leads, they have healthcare and social housing.

[–] [email protected] 12 points 4 days ago (1 children)

welp, TL;DR from comments says its fear mongering at best, physical access required right?

[–] [email protected] 4 points 3 days ago (1 children)

Code execution required lmao

[–] [email protected] 5 points 3 days ago

It allows the takeover of devices!

How?

By already having taken over the device.

Wtf is this reporting

[–] [email protected] 18 points 4 days ago

Does anyone know where it is that we can find these new commands? I have an esp32 dev kit just a few feet away from me as i read this. It might be interesting to know what these new product "features" are.

[–] [email protected] 2 points 4 days ago

Haha. I wear cheap Chinese bluetooth literally on my skull like 95% of the time, web when sleeping.

Hope they enjoy my thoughts.

[–] [email protected] 21 points 4 days ago (3 children)

The rebuttal wasn't as comforting as some are making it out to be. They seem to be more interested in the semantics of it not being a backdoor tied to a specific product, which appears to be true.

Rather it is a potential for vulnerability that exists in all wireless implementation, which seems to me to be a bigger issue.

[–] [email protected] 4 points 4 days ago (1 children)

It's a vulnerability where an attacker already needs code execution on the device/physical access.

If you have that you're already compromised no matter what.

[–] [email protected] 1 points 4 days ago (1 children)

The biggest risk would be IoT devices.

[–] [email protected] 2 points 3 days ago

That's just the summary of the entire existence of IoT devices

[–] [email protected] 4 points 4 days ago

The issue is where the undocumented commands are. They aren't just allowing any old external person to send payloads to this.

It's kind of like noticing that someone unexpectedly hid a spare key next to the door... On the inside of the house. Like, sure, maybe the owner would have like to know about that key, but since you have to be inside the house to get to it, it doesn't really make a difference.

[–] [email protected] 1 points 4 days ago

I was reading someone else's explanation and they said it's the equivalent of every computer possibly having a backdoor because there is code in a computer that a bad actor can use. There are extra commands that could possibly be used for a backdoor if a malicious actor found a way to use those bits of code. It's much less oh here is a security vulnerability that is being used and more of a if a robber breaks into our house which is possible they will rob us situation.

[–] [email protected] 37 points 5 days ago (1 children)

Please update the title of this post to mention the update

load more comments
view more: next ›