177
Undocumented "backdoor" found in Bluetooth chip used by a billion devices
(www.bleepingcomputer.com)
this post was submitted on 08 Mar 2025
177 points (88.3% liked)
Privacy
35316 readers
145 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The discoverers themselves refer to it as a backdoor, so frankly I don't know what you're on about accusing this article of misrepresenting their findings.
Huh, that is interesting. Though, that post doesn't seem to have any info about what the backdoor is either.
Maybe the presentation has nothing to do with the actual backdoor?
Though, this part later might seem to imply they are related:
Which, best I can work out, seems to be talking about the information on slide titled "COMANDOS OCULTOS" (page 39 / "41").
If the "backdoor" is the couple of commands in red on that slide, I maintain what I said above. If it's not talking about that and there's another "backdoor" that they haven't described yet, well, then ¯\_(ツ)_/¯ we'll see what it is when they actually announce it.
I fully acknowledge there may be something I'm missing. If there's a real vuln/backdoor here, I'm sure we'll hear more about it.
Maybe we can find out for sure through the magic of the fediverse...
@antoniovazquezblanco@mastodon.social Is the "backdoor" mentioned in https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ about what you shared in your RootedCON talk? If so, how worried should people using devices containing ESP32s be?
None. People that have physical access to you device can write malicious firmware. Which they can already do with physical access
It's an overblown nothing-burger. Calling it a backdoor is a security researcher juicing up some minor finding
Please correct if inaccurate, but I don't see in that article where the folks at Espressif refer to it as a backdoor, only the security company. This seems to me as though it is no more vulnerable than any other device which can be compromised by physical access, which is most of devices. The vulnerability really looks to be more in the ability to pivot to other devices remotely after one has been compromised physically, which isn't ideal, but still doesn't seem to me to be any less secure than most other devices.
I mean, if it were a backdoor, the one thing you can be sure of is that the people who put it there wouldn't be calling it a backdoor, ever.
Though, I think it's worth pointing out that the while the security company's blog calls whatever it is a "backdoor", "backdoor" (nor "puerta" (though, I have no idea if that would be translated literally or to something else)) doesn't appear in the the slides. So I'm going to lay that one at the marketing people trying to drum it up into something more impressive than it really is.