Hacker News: Undocumented backdoor found in Bluetooth chip used by a billion devices

Mar 8, 2025

—

Source URL: https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/
Source: Hacker News
Title: Undocumented backdoor found in Bluetooth chip used by a billion devices

Feedly Summary: Comments

AI Summary and Description: Yes

Summary: The discovery of an undocumented backdoor in the widely used ESP32 microchip presents significant security risks, especially in IoT devices. This backdoor allows for device spoofing, unauthorized access, and potential exploitation through Bluetooth and Wi-Fi, emphasizing the need for improved security vigilance in infrastructure that relies on such chips.

Detailed Description: The presentation by researchers Miguel Tarascó Acuña and Antonio Vázquez Blanco from Tarlogic Security revealed critical vulnerabilities within the ESP32 microchip manufactured by Espressif, which is extensively utilized in over 1 billion IoT devices. The following key points highlight the importance of this discovery for security professionals:

– **Undocumented Backdoor**: The ESP32 contains undocumented commands that enable various malicious activities, including:
– Spoofing of trusted devices.
– Unauthorized access to sensitive data.
– Potential pivoting to other network devices.
– Establishment of persistent threats within systems.

– **Research Findings**: The researchers noted that there was a decline in Bluetooth security research interest due to the inadequacy of working tools and outdated methodologies that failed to keep pace with modern systems. They developed a new C-based USB Bluetooth driver to combat this issue and gain more direct hardware access.

– **Hidden Vendor-Specific Commands**: Through their research, the team discovered 29 undocumented commands (Opcode 0x3F) that provide low-level control over Bluetooth functionality. These commands enable memory manipulation and packet injection.

– **Risks Identified**: The implications of these undocumented commands pose a serious threat regarding:
– Malicious implementations at the OEM level leading to supply chain vulnerabilities.
– Remote exploitation of the backdoor via malicious firmware or rogue connections.
– Potential for attackers with root access or malware to exploit the chip for broader attacks against other devices.

– **Security Context**: The presence of such vulnerabilities suggests that if an IoT device employing the ESP32 is compromised, it is feasible for attackers to remain hidden and launch advanced persistent threats (APTs) against other devices via Bluetooth or Wi-Fi.

– **Need for Awareness and Action**: Espressif has not commented on these findings, but the lack of documentation surrounding these commands raises questions about the oversight in manufacturing IoT components. This incident underlines the necessity for ongoing evaluation and fortification of security measures in software, hardware, and IoT infrastructure.

In conclusion, this finding underscores the critical need for security professionals to rigorously assess and secure their IoT deployments, especially when employing widely adopted components like the ESP32, which may harbor significant vulnerabilities unbeknownst to users.

1 2 3 a access Act advanced persistent threat advanced persistent threats AI and Arch as attack attackers attacks awareness backdoor based Bluetooth by C chain chip chips CIA code command compute computer Context control core critical D data de deployment document documentation e end Espressif evaluation exp exploit Exploitation fact fail firmware for functionality g Go gs H hack hacker Hacker News Harbor hardware high Highlight HR http HTTPS implementation implications in incident infrastructure injection inter IoT IoT Devices J k Key l led Lee Li logic low malicious activities malicious firmware malware man manipulation manufacturing memory Micro Mode Modern N network network devices news no o oE of on one opt ory out over oversight point potential pre professionals question R RCE red remote exploitation research researchers Risk risks Ro Root root access Rust s search sec secure security security measure security measures security professionals Security Research security risk security risks sensitive data Sig software source specific spoofing SSE supply supply chain supply chain vulnerabilities system systems T text the threat threats to tool tools TP trust two unauthorized access up US use user Users uth V val Valuation vendor vigilance vulnerabilities Ware Wi x