Comment on Undocumented 'Backdoor' Found In Chinese Bluetooth Chip Used By a Billion Devices.

RmDebArc_5@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

• badlotus@discuss.online ⁨1⁩ ⁨day⁩ ago

  Jews an article with a bit more detail… but I’m still unclear whether these backdoor commands are hardware circuits or firmware logic.

  Bleeping Computer: Undocumented “backdoor” found in Bluetooth chip used by a billion devices

  source

  • neuracnu@lemmy.blahaj.zone ⁨1⁩ ⁨day⁩ ago

    Solid article. I imagine the folks at the cyberwire podcast will be doing more digging over the weekend for a solid summary come Monday.

    source
  • Crafter72@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

    Thanks for the link, this article is more clear compared to the posted above.

    I’m more interested to the scope of the exploit whether it could touch the flash of the controller or not as you can also do OTA update through the BLE component.

    source
• Treczoks@lemmy.world ⁨1⁩ ⁨day⁩ ago

  It is not easy to determine how fixable this is. IIRC, the ESP32 has the wireless stack hidden from user space, and I am not sure if it is a blob included during link time, or if it is stored in a ROM of the chip. I do have the chips and the development enviroment in my studio, but (luckily) I decided to use a different chip for my project.

  But I know there is a load of systems using either the ESP32 as their main processor, or as an auxiliary processor to add WiFi or BT capabilities, so this really is a big oh shit moment.

  source
• ChaoticNeutralCzech@feddit.org ⁨20⁩ ⁨hours⁩ ago

  There is nothing to “fix”. Undocumented instructions have just been found in the silicon but they are not executable unless the ESP32’s firmware their owner flashed to give it a purpose uses them. No pre-2025 firmware that we know of uses these instructions, and they might turn out to be buggy so compilers might not adopt them. If they turn out OK, the documentation of the instruction set will need an update, and compilers will be able to take advantage of the new instructions.

  source