The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an undocumented "backdoor" that could be leveraged for attacks.
Update 3/9/25: After receiving concerns about the use of the term "backdoor" to refer to these undocumented commands, we have updated the title of our story.
@filmroellchen @BleepingComputer meh, reads like a nothingburger, and so does the official publication Undocumented HCI opcodes sound scary until you learn that you need local device access to even talk with HCI. so the attack surface is limited to whatever talks with the HCI stack (which in most projects is just esp-idf/FreeRTOS.
remote exploitation PoC || GTFO
@filmroellchen @domi @BleepingComputer As far as I can tell, this article is just bullshit. This is not a backdoor. HCI is not spoken over the air, instead it’s the local interface between the Bluetooth chipset and the application proscessor. It’s a trusted interface.
This doesn’t look like anyone’s “fault” to me, it just looks like a completely harmless debugging feature someone who either doesn’t know what they are doing or who is chasing clout is trying to blow up into a scandal.
Is this one of those cases where the device vendor is trying to prevent the buyer from doing whatever they want with the hardware they now own?
The owner of hardware being able to do more with the hardware than it was intended to do should generally not be classified as a vulnerability.
@kasperd it’s very much not such a case. The espressif chips are freely programmable, and espressif even supplies a decent free and mostly open source SDK. Here, these security consulting clowns really just took apart an example firmware that espressif provides for convenience so you don’t have to write your own.
You’re right, this isn’t the hardware doing anything inherently bad.
In that case it sounds like somewhere along the way somebody have been misrepresenting the information. The slides I found are not in a language I understand, so for now I'll not try to judge who has been misrepresenting the information.
Extra undocumented features should only be considered a vulnerability or a backdoor if they can be used for privilege escalation or similar.
I see. I usually expect to find more technical information in slides and presentation. I just took another look and saw that there is indeed one more link than what I looked at previously.
I read part of that press release, but at some point I just didn't want to read any more of it. The press release are using a lot of words to say essentially nothing. They describe the impact as if they discovered a fundamental flaw in the Bluetooth protocol itself. But from the press release I learned nothing about what the supposed vulnerability is.
You have convinced me that they are exaggerating the problem. I am now quite uncertain whether there was a vulnerability in the first place.
BleepingComputer
cat::<kleinesFilmröllchen>
dmi đź’˝ 
jaseg
kasperd