The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an undocumented "backdoor" that could be leveraged for attacks.
Update 3/9/25: After receiving concerns about the use of the term "backdoor" to refer to these undocumented commands, we have updated the title of our story.
@filmroellchen @BleepingComputer meh, reads like a nothingburger, and so does the official publication Undocumented HCI opcodes sound scary until you learn that you need local device access to even talk with HCI. so the attack surface is limited to whatever talks with the HCI stack (which in most projects is just esp-idf/FreeRTOS.
remote exploitation PoC || GTFO
@filmroellchen @domi @BleepingComputer As far as I can tell, this article is just bullshit. This is not a backdoor. HCI is not spoken over the air, instead it’s the local interface between the Bluetooth chipset and the application proscessor. It’s a trusted interface.
This doesn’t look like anyone’s “fault” to me, it just looks like a completely harmless debugging feature someone who either doesn’t know what they are doing or who is chasing clout is trying to blow up into a scandal.
Is this one of those cases where the device vendor is trying to prevent the buyer from doing whatever they want with the hardware they now own?
The owner of hardware being able to do more with the hardware than it was intended to do should generally not be classified as a vulnerability.
@kasperd it’s very much not such a case. The espressif chips are freely programmable, and espressif even supplies a decent free and mostly open source SDK. Here, these security consulting clowns really just took apart an example firmware that espressif provides for convenience so you don’t have to write your own.
You’re right, this isn’t the hardware doing anything inherently bad.
In that case it sounds like somewhere along the way somebody have been misrepresenting the information. The slides I found are not in a language I understand, so for now I'll not try to judge who has been misrepresenting the information.
Extra undocumented features should only be considered a vulnerability or a backdoor if they can be used for privilege escalation or similar.
I see. I usually expect to find more technical information in slides and presentation. I just took another look and saw that there is indeed one more link than what I looked at previously.
I read part of that press release, but at some point I just didn't want to read any more of it. The press release are using a lot of words to say essentially nothing. They describe the impact as if they discovered a fundamental flaw in the Bluetooth protocol itself. But from the press release I learned nothing about what the supposed vulnerability is.
You have convinced me that they are exaggerating the problem. I am now quite uncertain whether there was a vulnerability in the first place.
@jaseg @filmroellchen @domi @BleepingComputer It certainly seems like exactly this.
Without a secondary bug (that the researchers don't have), it seems like this would only become a security issue if someone made a product that exposes the HCI interface over serial (i.e. to another host embedded computer), and then used the ESP32 hardware security features to lock down the ESP32 against reprogramming. In that case, an attacker with access to that wired HCI serial interface could potentially reprogram the chip - bypassing the hardware security protections.
But almost every ESP32 in the world runs its own custom firmware and doesn't accept HCI commands over serial at all. In all those cases, this "attack" requires an arbitrary code execution exploit first... and if you have code execution, you can already do all those things and more.
(Disclaimer: I have previously worked for Espressif, but not since 2021.)
@jaseg @filmroellchen @domi @BleepingComputer Also kind of irked that (unless I missed it in the slides) the researchers didn't try to do any responsible disclosure. This would be trivially easy to patch (the HCI command handler checks for the vendor prefix and disallows it), and that would prevent the limited use cases where this is exploitable.
I assume Espressif will patch it now it's public.
BleepingComputer
cat::<kleinesFilmröllchen>
dmi đź’˝ 
matthew
jaseg
kasperd
Gus
đź’¬
chrysn