this post was submitted on 08 Mar 2025
743 points (94.8% liked)

Technology

64653 readers
4283 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
743
Undocumented 'Backdoor' Found In Bluetooth Chip Manufactured in China Used By a Billion Devices. (www.tarlogic.com)
submitted 17 hours ago* (last edited 1 hour ago) by Tea@programming.dev to c/technology@lemmy.world
126 comments fedilink hide all child comments
 

Source Link Privacy.Privacy test result

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

top 50 comments
sorted by: hot top controversial new old
[–] jerkface@lemmy.ca 11 points 1 hour ago

Weird that they removed the reference to ESP32, one of the most common and widely known microcontrollers, from the headline.

[–] Thrawne@lemmy.world 0 points 12 minutes ago

Fukin dmnit! I just spent the last several months fine tuning a PCB design supporting this platform. I have , what i believe to be my last iteration, being sent to fab now. I have to look i to this. My solution isnt using bluetooth, so i dont know if im vulnerable.

[–] fuamerikkka@lemm.ee 11 points 1 hour ago (1 children)

This turned racist / xenophobic real quickly.

There have been several other posts about this without mentioning China at all, especially in the post itself.

No where in the article does it say "chinese", literally anywhere.

The chip is MANUFACTURED in China.

Check your racism.

[–] Tea@programming.dev 6 points 1 hour ago* (last edited 1 hour ago) (1 children)

I actually wanted to keep the title short, but I think it would be better to edit the title to avoid any confusion to make it clear that it's manufactured in China, rather than saying it in the current way.

Edit: I edited the title to reflect the details better.

[–] fuamerikkka@lemm.ee 0 points 1 hour ago (1 children)

Thank you, your explanation / edit is much appreciated 👏 🥳 ❤️

[–] Tea@programming.dev 3 points 1 hour ago (1 children)

💜Thank you for correcting me.

I edited it now 😄

[–] fuamerikkka@lemm.ee 2 points 1 hour ago

Also, thank you for showing people that there's space for these types of comments that lead to a pleasant and meaningful exchange!

This means more to me than you know 🥹

Appreciate you!

❤️🩷🧡💛💚💙🩵💜🤎🖤🩶🤍

[–] fubarx@lemmy.ml 54 points 6 hours ago (1 children)

This sounds like there are some undocumented opcodes on the HCI side -- the Host Computer Interface -- not the wireless side. By itself, it's not that big a deal. If someone can prove that there's some sort of custom BLE packet that gives access to those HCI opcodes wirelessly, I'd be REALLY concerned.

But if it's just on the host side, you can only get to it if you've cracked the box and have access to the wiring. If someone has that kind of access, they're likely to be able to flash their own firmware and take over the whole device anyway.

Not sure this disclosure increases the risk any. I wouldn't start panicking.

[–] Bloomcole@lemmy.world 3 points 1 hour ago

So explained to me, a tech illiterate in comparison, this is China bad scaremongering?
'Backdoor' sounds malicious with intent.

[–] ycnz@lemmy.nz 85 points 10 hours ago

I hate it when an attacker who already has root access to my device gets sightly more access to the firmware. Definitely spin up a website and a logo, maybe a post in Bloomberg.

[–] notanapple@lemm.ee 121 points 13 hours ago (4 children)

We really should be pushing for fully open source stack (firmware, os) in all iot devices. They are not very complicated so this should be entirely possible. Probably will need a EU law though.

[–] oldfart@lemm.ee 12 points 4 hours ago (1 children)

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

[–] notanapple@lemm.ee 3 points 4 hours ago (1 children)

thats a very fair point, I had not seen anyone else make this one But the problem is that in this case, this functionality was entirely undocumented. I dont think it was intended for programmers.

Now if the firmware was open source, people would have gotten to know about this much sooner even if not documented. Also such functionality should ideally be gated somehow through some auth mechanism.

Also just like how the linux kernel allows decades old devices to be at the very least patched for security risks, open firmware would allow users of this chip to patch it themselves for bugs, security issues.

[–] oldfart@lemm.ee 3 points 4 hours ago

Yeah, of course, it would be better in many ways if the firmware wasn't closed.

[–] rottingleaf@lemmy.world 7 points 6 hours ago

Backdoored devices are useful for people who can impede that.

And the way EU is approaching privacy, surveillance and all such, - oh-hoh-ho, I don't think there will be a EU law.

[–] secret300@lemmy.sdf.org 15 points 7 hours ago (1 children)

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

[–] ChaoticNeutralCzech@feddit.org 1 points 1 hour ago

This is about silicon. Undocumented instructions have just been found in it but they are not executable unless the ESP32's firmware uses them. Firmware cannot be edited to use them unless you have an existing vulnerability such as physical access or insecure OTA in existing firmware (as far as researchers know).

load more comments (1 replies)
[–] NightCrawlerProMax@lemmy.world 45 points 13 hours ago (13 children)

The other day someone posted in Canada community that Canada should stop using Tesla cars and import Chinese cars. I replied saying, “That’s like replacing one evil with another.” I was downvoted by a lot of people. I should’ve expected it cuz a lot of people have short term memory.

[–] matlag@sh.itjust.works 25 points 10 hours ago (2 children)

Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.

For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.

[–] themurphy@lemmy.ml 12 points 7 hours ago

Europe and its 50 car makers could also be considered instead of China..

[–] NightCrawlerProMax@lemmy.world 7 points 7 hours ago (1 children)

CCP has backdoor into every tech that comes out of China. It’s not about just privacy. They control democracies based on shaping narratives. They’ll utilize everything that democracy offers and use it against countries. They don’t have freedom of speech or press so they themselves are not victims of it. EVs are really just computers on the road. Flooding the market with Chinese EVs would just mean creating a massive free network on a foreign soil for them.

[–] freely1333@reddthat.com 1 points 3 hours ago

As opposed to the teslas with the back doors for the us government… but will be moot when Canada is part of the states anyway

[–] Montreal_Metro@lemmy.ca 9 points 9 hours ago* (last edited 9 hours ago) (2 children)

A lot of people are dumb. Or maybe because they feel offended because they are Chinese, but the reality is that every Chinese company is ultimately controlled by the CCP. If I was fighting a cold war, I would do the same. Sell compromised devices to my trade partners (AKA enemies) so I have leverage when I need it.

[–] IDKWhatUsernametoPutHereLolol@lemmy.dbzer0.com 3 points 1 hour ago

Or maybe because they feel offended because they are Chinese

I'm Chinese-American and I'm not offended. The tankies from .ml are

load more comments (1 replies)
load more comments (11 replies)
[–] Ebby@lemmy.ssba.com 170 points 16 hours ago (27 children)

Well... Shit.

There are so, so, so, many ESP32's in not just my house, but practically everyone I know.

There outta be fines for this BS.

load more comments (27 replies)
load more comments
view more: next ›