Comment on Undocumented "backdoor" found in Bluetooth chip used by a billion devices

randompasta@lemmy.today ⁨1⁩ ⁨day⁩ ago

• Xanza@lemm.ee ⁨1⁩ ⁨day⁩ ago

  HeartBleed level.

  source

  • chaospatterns@lemmy.world ⁨1⁩ ⁨day⁩ ago

    No way they’re on the same level. Heartbleed allowed for remote memory reads. This requires you to have access to change the firmware.

    source

    • Xanza@lemm.ee ⁨1⁩ ⁨day⁩ ago

      No way they’re on the same level. Heartbleed allowed for remote memory reads.

      I professionally studied HeartBleed as a security researcher and wrote a peer reviewed opinion piece which was published. I won’t say where or the title because it would give you my full name, so deal with it. Not trying to humble-brag, just trying to say, I’ve done the research myself here.

      HeartBleed was an oversight which sent out enabled by default (!) a TLS heartbeat read overrun error in OpenSSL v1.0.1 to 1.0.2-beta which allowed any third party with an internet connection the ability to request information, 64kb at a time, stored in an affected servers memory. Anything. Private keys, encryption keys, TLS private keys (imagine SSL verified MITM attacks), decrypted sensitive files (which are HDD encrypted and decrypted in memory), passwords, anything.

      All’s you had to do was know how to request the information, and the server you wanted to attack. It went undiscovered for a number of months before it was found. The extension was enabled by default, and came bundled with software used on literally billions of private computing devices, servers, IoT devices, and even interstitial devices used over network connection.

      Here’s an excerpt from some other security researchers on the subject, in case you don’t want to take my word for it;

      We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication. 1

      You’re correct that they’re not on the same level, but completely backwards in thinking that an undocumented bluetooth backdoor is worse than the worst vulnerability found since the invention of the internet. HeartBleed affected hundreds of millions of critical servers. Literally billions of devices in total. How many consumer devices do you think have this exact bluetooth chip? 10,000? 100,000? 10 million? Still small peanuts in comparison.

      source

      • chaospatterns@lemmy.world ⁨1⁩ ⁨day⁩ ago

        but completely backwards in thinking that an undocumented bluetooth backdoor is worse than the worst vulnerability found since the invention of the internet

        Right HeartBleed was way worse than this, not on the same level. I wasn’t claiming the opposite.

        I was responding to the comment that appeared to suggest they were on the same level.

        source

        • -> View More Comments
      • Buelldozer@lemmy.today ⁨1⁩ ⁨day⁩ ago

        How many consumer devices do you think have this exact bluetooth chip?

        Hundreds of millions. They’re used in an almost uncountable number of IoT devices. It’s entirely possible that there’s a handful of 'em, or more, in your house. Absolutely anything “smart” that uses WiFi or Bluetooth could have one including sprinkler controllers, door locks, lightbulbs, appliances both large and small, garage door openers, and remote controlled power plugs.

        Espressif has sold a huge number of ESP32 chips. This isn’t some uncommon no-name manufacturer or chip. It’s used at scale and has been for years.

        That you aren’t personally aware of it only means that you have a blind spot.

        source

        • -> View More Comments
  • dzso@lemmy.world ⁨22⁩ ⁨hours⁩ ago

    Can someone explain how to know if my devices have this chip, what risks it exposes me to, and what, if anything, I should do to protect myself?

    source

    • Dekkia@this.doesnotcut.it ⁨19⁩ ⁨hours⁩ ago

      You can use an online tool to look up the Bluetooth [1] or Wifi [2] MAC of the device. If it’s espressive you’ve got one of their chips. That doesn’t guerantee that it’s not one of the others they make. You can also open up the device and look for the esp32. They almost always look the same with their metal can ontop.

      The risk has been estimated as 0.3 out of 10

      Don’t worry about it.

      [1] ipnet.tools/bluetooth-device-address-lookup-tool [2] ipnet.tools/mac-lookup-tool

      source