1028
Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices.
(www.tarlogic.com)
Source Link Privacy.
Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.
Update: The ESP32 "backdoor" that wasn't.
Well... Shit.
There are so, so, so, many ESP32's in not just my house, but practically everyone I know.
There outta be fines for this BS.
You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.
This is a security firm making everything sound scary because they want you to buy their testing device.
Wrong. Read the analysis. It is a BT vulnerability. One can probably design a cheap attack system that just sends a erase flash command to any BT device in reach, instantly bricking every BT enabled ESP32 device.
Just reread it and no, it's not a BT vulnerability. The "erase flash" command is something that has to be done by software running outside the BT stack. You can even see that inside the slides. The
UsbBluetoothsoftware is connected to the device with the flawed bluetooth chipset.The vulnerability is that if you have this chipset and compromised software, someone can flash the chipset with compromised flash. They even say that it's not an easy attack to pull off in the article.
In otherwords, the attack is something that can only be pulled off if there's also a security vulnerability within other parts of the hardware stack.
Yeah, that's not the main concern.