Source Link Privacy.

Privacy test result

https://themarkup.org/blacklight?url=https%3A%2F%2Fwww.tarlogic.com%2Fnews%2Fbackdoor-esp32-chip-infect-ot-devices%2F&device=mobile&location=us-ca&force=false

Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices. Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls.

Update: The ESP32 “backdoor” that wasn’t.

  • Ebby@lemmy.ssba.com
    link
    fedilink
    English
    arrow-up
    0
    ·
    10 days ago

    Well… Shit.

    There are so, so, so, many ESP32’s in not just my house, but practically everyone I know.

    There outta be fines for this BS.

    • cogman@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      10 days ago

      You’re fine. This isn’t something that can be exploited over wifi. You literally need physical access to the device to exploit it as it’s commands over USB that allow flashing the chip.

      This is a security firm making everything sound scary because they want you to buy their testing device.

        • cogman@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          10 days ago

          I just re-read the article and yes, you still need physical access.

          The exploit is one that bypasses OS protections to writing to the firmware. In otherwords, you need to get the device to run a malicious piece of code or exploit a vulnerability in already running code that also interacts with the bluetooth stack.

          The exploit, explicitly, is not one that can be carried out with a drive-by Bluetooth connection. You also need faulty software running on the device.

          • Blue_Morpho@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            10 days ago

            “Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections.”

            I of course don’t know details but I’m basing my post on that sentence. “Backdoor may be possible via … rogue Bluetooth connections.”