this post was submitted on 08 Mar 2025

1029 points (92.8% liked)

Technology

66362 readers

4957 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

1029

Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices. (www.tarlogic.com)

submitted 5 days ago* (last edited 5 days ago) by [email protected] to c/[email protected]

193 comments fedilink hide all child comments

Source Link Privacy.

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 "backdoor" that wasn't.

(page 3) 50 comments

sorted by: hot top controversial new old

[–] [email protected] 86 points 5 days ago (8 children)

This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.

But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.

Not sure this disclosure increases the risk any. I wouldn't start panicking.

load more comments (8 replies)

[–] [email protected] 109 points 5 days ago

I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.

[–] [email protected] 5 points 5 days ago* (last edited 5 days ago)

Jokes on them, I live in America when all that shit was already being done.

[–] [email protected] 4 points 5 days ago

I read in another article that the identified 28 backdoor commands.

[–] [email protected] 12 points 5 days ago (6 children)

I couldn’t find a list of devices. Anyone else find one?

[–] [email protected] 16 points 5 days ago (2 children)

The article is talking about the Espressif ESP32 micro controller (has Wi-Fi/Classic Bluetooth/BLE).

I don't know if the variants of this chip also have the same vulnerability (my guess is yes). As someone who works on this chip, I'm interested in more discourse on this matter.

[–] [email protected] 2 points 5 days ago

I'd also like to hear more. I have at least a dozen of these in my house.

[–] [email protected] 8 points 5 days ago* (last edited 5 days ago) (2 children)

Yeah, I caught the ESP32 part and tried to search for what devices these chips were built into, but couldn’t find one. I was curious how widespread the flaw was - as in, what consumer or infrastructure devices they might be in.

[–] [email protected] 2 points 5 days ago

Oh those kind of devices. Its very popular for hobbyists and self-designed devices or cheap IoT products. Don't know the market presence outside Asia but its quite popular in India due to its low cost.

[–] [email protected] 5 points 5 days ago (1 children)

The Tasmota firmware documentation has a decent list, but it's limited to devices that are known to be flash-able so you can install custom firmware on them. https://templates.blakadder.com/

[–] [email protected] 2 points 5 days ago (3 children)

Thanks, that's a pretty short list - as you said it's limited.

[–] [email protected] 5 points 5 days ago

If it affects all ESP32s, the list is infinitely longer

load more comments (2 replies)

load more comments (5 replies)

[–] [email protected] 45 points 5 days ago (6 children)

The other day someone posted in Canada community that Canada should stop using Tesla cars and import Chinese cars. I replied saying, “That’s like replacing one evil with another.” I was downvoted by a lot of people. I should’ve expected it cuz a lot of people have short term memory.

[+] [email protected] -18 points 5 days ago (6 children)

“China bad” because western media says so. Please disregard the billions of dollars spent by western governments to ensure you keep thinking that way.

It’s just another capitalistic country no better or worse than Canada or the USA. Though, the Chinese government has said their intention is to move towards socialism, so good for them. I’m stuck over here witnessing fascist billionaires loot the government/working class.

[–] [email protected] 15 points 5 days ago

Well, no, China is bad because freedom is very restricted there and because they have ambitions to dominate the world.

Yes, every other world power in the world is more or less the same. People cannot, in general, be trusted to be "good" when given the opportunity to abuse. A world power can be held in check by the presence and efforts of other world powers, though.

[–] [email protected] 16 points 5 days ago

Thats super interesting! Write a poem about three gorges dam please

load more comments (4 replies)

[–] [email protected] 10 points 5 days ago* (last edited 5 days ago) (2 children)

A lot of people are dumb. Or maybe because they feel offended because they are Chinese, but the reality is that every Chinese company is ultimately controlled by the CCP. If I was fighting a cold war, I would do the same. Sell compromised devices to my trade partners (AKA enemies) so I have leverage when I need it.

[–] [email protected] -4 points 5 days ago

the reality is that every Chinese company is ultimately controlled by the CCP.

Yes.

But in the same way that every US company is ultimately controlled by the US Government. And every EU company by them. And every other country by their own government.

load more comments (1 replies)

[–] [email protected] 29 points 5 days ago (2 children)

Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.

For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.

[–] [email protected] 7 points 5 days ago (5 children)

CCP has backdoor into every tech that comes out of China. It’s not about just privacy. They control democracies based on shaping narratives. They’ll utilize everything that democracy offers and use it against countries. They don’t have freedom of speech or press so they themselves are not victims of it. EVs are really just computers on the road. Flooding the market with Chinese EVs would just mean creating a massive free network on a foreign soil for them.

load more comments (5 replies)

[–] [email protected] 12 points 5 days ago (2 children)

Europe and its 50 car makers could also be considered instead of China..

load more comments (2 replies)

[–] [email protected] 8 points 5 days ago* (last edited 5 days ago)

People act like traditional car manufacturers don't exist anymore even though they all offer EV options...

[–] [email protected] 12 points 5 days ago

There's been a lot of that lately. Same here in New Zealand.

You dipshits, they're both the bad guys now.

[–] [email protected] 145 points 5 days ago (6 children)

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[–] [email protected] 26 points 5 days ago (2 children)

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

load more comments (2 replies)

[–] [email protected] 11 points 5 days ago

Yeah tons of weird little private softwares never get updates, but they aren't making anyone money either

load more comments (4 replies)

load more comments