Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices.
Undocumented Commands Found In Bluetooth Chip Manufactured in China Used By a Billion Devices.
Source Link Privacy.
Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.
Update: The ESP32 "backdoor" that wasn't.
Gotta blame China to get upvoted on Lemmy.
Please update the title of this post to mention the update
This isn't a backdoor. Just a company trying to make name for themselves by sensationalizing a much smaller discovery.
Fukin dmnit! I just spent the last several months fine tuning a PCB design supporting this platform. I have , what i believe to be my last iteration, being sent to fab now. I have to look i to this. My solution isnt using bluetooth, so i dont know if im vulnerable.
Its not a backdoor, you're most likely fine.
Weird that they removed the reference to ESP32, one of the most common and widely known microcontrollers, from the headline.
This turned racist / xenophobic real quickly.
There have been several other posts about this without mentioning China at all, especially in the post itself.
No where in the article does it say "chinese", literally anywhere.
The chip is MANUFACTURED in China.
Check your racism.
I agree we shouldn't be racist against Chinese people, but you're ignorant. From wikipedia: ESP32 is created and developed by Espressif Systems, a Chinese company based in Shanghai, and is manufactured by TSMC using their 40 nm process.It is a successor to the ESP8266 microcontroller.
So it's designed/developed in China and manufactured in Taiwan; not China.
Dog whistling.
This has nothing to do with the chip or who makes it.
It's the way it's written.
You missed the point.
No. Fuck the Chinese. All 17billion of them.
/s
I actually wanted to keep the title short, but I think it would be better to edit the title to avoid any confusion to make it clear that it's manufactured in China, rather than saying it in the current way.
Edit: I edited the title to reflect the details better.
This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.
But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.
Not sure this disclosure increases the risk any. I wouldn't start panicking.
So explained to me, a tech illiterate in comparison, this is China bad scaremongering?
'Backdoor' sounds malicious with intent.The article is a security company trying to hype their company with a theoretical attack that currently has no hypothetical way to be abused
The article has an update now fixing the wording to "hidden feature" but, spoilers, every BT device has vendor specific commands.
The documentation of the part just wasn't complete and this companies "fuzzing" tool found some vendor commands that weren't in the data sheet
The China part just came from OP
I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.
We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.
Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.
Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!
thats a very fair point, I had not seen anyone else make this one But the problem is that in this case, this functionality was entirely undocumented. I dont think it was intended for programmers.
Now if the firmware was open source, people would have gotten to know about this much sooner even if not documented. Also such functionality should ideally be gated somehow through some auth mechanism.
Also just like how the linux kernel allows decades old devices to be at the very least patched for security risks, open firmware would allow users of this chip to patch it themselves for bugs, security issues.
I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.
This is about silicon. Undocumented instructions have just been found in it but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).
Backdoored devices are useful for people who can impede that.
And the way EU is approaching privacy, surveillance and all such, - oh-hoh-ho, I don't think there will be a EU law.
Yeah tons of weird little private softwares never get updates, but they aren't making anyone money either
The other day someone posted in Canada community that Canada should stop using Tesla cars and import Chinese cars. I replied saying, “That’s like replacing one evil with another.” I was downvoted by a lot of people. I should’ve expected it cuz a lot of people have short term memory.
Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.
For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.
CCP has backdoor into every tech that comes out of China. It’s not about just privacy. They control democracies based on shaping narratives. They’ll utilize everything that democracy offers and use it against countries. They don’t have freedom of speech or press so they themselves are not victims of it. EVs are really just computers on the road. Flooding the market with Chinese EVs would just mean creating a massive free network on a foreign soil for them.
A lot of people are dumb. Or maybe because they feel offended because they are Chinese, but the reality is that every Chinese company is ultimately controlled by the CCP. If I was fighting a cold war, I would do the same. Sell compromised devices to my trade partners (AKA enemies) so I have leverage when I need it.
Or maybe because they feel offended because they are Chinese
I'm Chinese-American and I'm not offended. The tankies from .ml are
the reality is that every Chinese company is ultimately controlled by the CCP.
Yes.
But in the same way that every US company is ultimately controlled by the US Government. And every EU company by them. And every other country by their own government.
There's been a lot of that lately. Same here in New Zealand.
You dipshits, they're both the bad guys now.
People act like traditional car manufacturers don't exist anymore even though they all offer EV options...
Everyone has short-term memory and long-term memory. You're misunderstanding precisely what "short-term memory" refers to. Short-term memory is held for a short time before it's converted to long-term memory. What you're referring to is being short-sighted. As in people who don't fully think about the long-term consequences of current actions. Said short-sighted people still have both short and long-term memory. They're probably just a little dumb so they don't fully utilize the memories stored long-term.
Jesus. Okay. So when you say, "being short sighted", you don't literally mean the geometry of their eyes is myopic. You mean it figuratively. Exactly like the person you are correcting clearly means it figuratively when they say "short-term memory".
“China bad” because western media says so. Please disregard the billions of dollars spent by western governments to ensure you keep thinking that way.
It’s just another capitalistic country no better or worse than Canada or the USA. Though, the Chinese government has said their intention is to move towards socialism, so good for them. I’m stuck over here witnessing fascist billionaires loot the government/working class.
No, 'China bad' because many many examples of China bad. Such as the topic of this post.
The whole "you can't criticize China because you're from a country that also does bad things" is logically worthless. It's the appeal to hypocrisy fallacy.
Not sure if you realize this but China is also ruled by a kleptocratic billionaire class that loots the working class even moreso than the US, so i'm not sure why you look up to them - China has more billionaires and a much larger wealth divide than the US. Actions speak louder than words and while Xi and the CCP often talk about cracking down on thier ultra-wealthy, they don't really do much - couple billionaires might disappear occasionally though if they don't praise the party line publically. One thing is for sure - I don't see any elite CCP party members that are not also very wealthy. And it's everyone else that's propagandized 🤔
Thats super interesting! Write a poem about three gorges dam please
Well, no, China is bad because freedom is very restricted there and because they have ambitions to dominate the world.
Yes, every other world power in the world is more or less the same. People cannot, in general, be trusted to be "good" when given the opportunity to abuse. A world power can be held in check by the presence and efforts of other world powers, though.
Well... Shit.
There are so, so, so, many ESP32's in not just my house, but practically everyone I know.
There outta be fines for this BS.
You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.
This is a security firm making everything sound scary because they want you to buy their testing device.
You literally need physical access to the device to exploit it
You don't need physical access. Read the article. The researcher used physical USB to discover that the Bluetooth firmware has backdoors. It doesn't require physical access to exploit.
It's Bluetooth that's vulnerable.
Too much fanfare and too little real info shared to be of any value. Sounds more like an ad than infosec
Exactly what it is. A gross example of company trying to get their name out their by sensationalizing their findings.
Seriously wtf did I just try to read? It sounded like AI slop.
The Chinese adding back doors into their software/hardware.
Say it ain't so!
It ain't so.
To use the "backdoor" an attacker needs to have full access to the esp32 powered device already.
It's like claiming that being able to leave your desk without locking your PC is a backdoor in your OS.
Yes, this is about undocumented instructions found in the silicon but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).
It is good to question the "backdoor" allegations - maybe the instructions' microcode was buggy and they didn't want to release it.
Say it ain't so
Your bug is a heartbleeder
Say it ain't so
My NIC is a bytetakertech backdoors are only okay when us good guys require em
How about all tech backdoors are bad and we should aim to use and make software and hardware that is ethically produced and usable without selling out your privacy and security?
China ain't our friend but neither is our own regime, I don't get the normies only caring about privacy and security when chinaman do the thing
Then they tuck their dicks because they got nothing to hide when domestic spook is doing the same
pathetic and intellectually disingenuous
Like a PRISM for China, is every powerful country just backdooring each other?
Thats hot.
I couldn’t find a list of devices. Anyone else find one?
That's like saying "I want a list of all devices with ATmega328P." Anyone can make a unique device with this chip as the processor, in fact I have. It's a chip with an extremely low barrier of entry thanks to extensive documentation, lots of dev boards and libraries. Not as low as the 555 (lots of people's first IC) but WAY lower than anything you'd traditionally consider a 32-bit CPU.
Anyway, even if you obtained the list magically, it would be of little use. To be clear: this is not an exploit. The chip just has more instructions than previously thought – instructions that you write into your program when building an ESP32 device. This can make some programs a little faster or smaller but you still need to flash them onto the microcontroller – using physical access, OTA (if you set it up in the existing FW) or some exploit (in someone's OTA implementation, perhaps).
The article is talking about the Espressif ESP32 micro controller (has Wi-Fi/Classic Bluetooth/BLE).
I don't know if the variants of this chip also have the same vulnerability (my guess is yes). As someone who works on this chip, I'm interested in more discourse on this matter.
I'd also like to hear more. I have at least a dozen of these in my house.
I’d like to know if this is just a firmware update or unfixable, but sadly this seems just an ad rather than news
There is nothing to "fix". Undocumented instructions have just been found in the silicon but they are not executable unless the ESP32's firmware their owner flashed to give it a purpose uses them. No pre-2025 firmware that we know of uses these instructions, and they might turn out to be buggy so compilers might not adopt them. If they turn out OK, the documentation of the instruction set will need an update, and compilers will be able to take advantage of the new instructions.
Here’s an article with a bit more detail… but I’m still unclear whether these backdoor commands are hardware circuits or firmware logic.
Bleeping Computer: Undocumented "backdoor" found in Bluetooth chip used by a billion devices
Thanks for the link, this article is more clear compared to the posted above.
I'm more interested to the scope of the exploit whether it could touch the flash of the controller or not as you can also do OTA update through the BLE component.
Solid article. I imagine the folks at the cyberwire podcast will be doing more digging over the weekend for a solid summary come Monday.
Even if it were fixable, it would be up to manufacturers to push updates. I doubt any really care enough.
It is not easy to determine how fixable this is. IIRC, the ESP32 has the wireless stack hidden from user space, and I am not sure if it is a blob included during link time, or if it is stored in a ROM of the chip. I do have the chips and the development enviroment in my studio, but (luckily) I decided to use a different chip for my project.
But I know there is a load of systems using either the ESP32 as their main processor, or as an auxiliary processor to add WiFi or BT capabilities, so this really is a big oh shit moment.
Jokes on them, I live in America when all that shit was already being done.
One more reason to have actual open-source drivers instead of binary blobs..
Not the first time a backdoor was found on Chinese made hardware and it won‘t be the last time. Decoupling can‘t happen quickly enough.
True, but the ESP32 is used by a lot of devices. This backdoor is pretty huge in scope of devices impacted.
It depends on what the method of attack is. I'm not seeing anything saying that it would be possible to exploit wirelessly, so this could easily be mostly a non-issue.
I mean, most users here are browsing using a device with an AMD or Intel CPU, both with known backdoors. Not the first time a backdoor was found on American made hardware and it won't be the last.
I read in another article that the identified 28 backdoor commands.
Is this some hardware flaw, or just something in their standard BT stack?
I was wondering the same thing. Wasn't clear on whether these backdoors are there on purpose or because of mistakes
I have a bunch of ESP32's that ... I can update and replace the firmware on, if i reset it the right way with a usb cable. the web site doesn't explain it any way how this is any worse than that...?
The website is also the guy trying to sell the solution so I'm just sceptical for now
This can be done wirelessly, if the custom driver has been installed.
Yeah one of my more… tech adventurous friends had the most insane series of security breaches (to out it mildly) potentially related to this and some other recent ridiculousness.
What do you mean
So, what is the probability of it affecting a lot of people?
The blob strikes again
Hey look china got caught putting backdoors in hardware AGAIN
The ESP32 chip, developed by Espressif Systems, is widely used in various IoT (Internet of Things), embedded systems, and consumer electronics due to its low power consumption, built-in Wi-Fi & Bluetooth, and high processing capability.
Devices That Use the ESP32 Chip
- Development Boards & Microcontrollers
ESP32 DevKit series (official Espressif boards)
M5Stack and M5Stick series
Adafruit HUZZAH32
SparkFun ESP32 Thing
LilyGO T-Series (T-Display, T-SIM, T-Watch, etc.)
WEMOS Lolin D32/D32 Pro
- Smart Home & IoT Devices
Sonoff Smart Switches and Plugs (e.g., Sonoff Mini R3, Sonoff S31)
Shelly Smart Relays (e.g., Shelly 1, Shelly 2.5)
Tuya-Based Smart Devices (many smart home products use Tuya firmware on ESP32)
Air quality monitors (e.g., AirGradient open-source air sensors)
IoT Sensor Hubs (various DIY and commercial solutions)
- Wearables & Portable Devices
TTGO T-Watch (ESP32-based smartwatch)
Heltec WiFi Kit Series (LoRa-enabled IoT devices)
Fitness trackers (some DIY and prototype models)
- Robotics & DIY Electronics
ESP32-CAM (ESP32-based camera module)
DIY drones & robots (used in hobbyist and educational robotics)
3D Printer controllers (e.g., ESP32-based Klipper controllers)
- Industrial & Commercial Products
ESP32-based vending machines (wireless payment systems)
Smart irrigation controllers
Energy monitoring devices (e.g., OpenEnergyMonitor)
Smart locks & security systems
- Audio & Multimedia Devices
ESP32-based web radios
DIY Bluetooth speakers
Smart light controllers with voice assistants
Why Is ESP32 Popular?
✔ Low-cost & powerful (dual-core, Wi-Fi, Bluetooth) ✔ Great for DIY & commercial IoT applications ✔ Strong developer community & open-source support ✔ Compatible with Arduino, MicroPython, ESP-IDF, etc.