Undocumented "backdoor" found in Bluetooth chip used by a billion devices

[Kaz]

  Quote

 

The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an undocumented "backdoor" that could be leveraged for attacks.

The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence.

...

The researchers warned that ESP32 is one of the world's most widely used chips for Wi-Fi + Bluetooth connectivity in IoT (Internet of Things) devices, so the risk of any backdoor in them is significant.

 

Expand  

 

Undocumented "backdoor" found in Bluetooth chip used by a billion devices

WWW.BLEEPINGCOMPUTER.COM

---

The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an...

 

This feeds into what Christopher Domas was saying about the concerns of hardware back doors and the potential for hidden commands.  It's why the U.S. developed the Chips and Science Act to subsidize chip manufacturing in the US.  I don't think hardware designers are done trying to backdoor their equipment.

 

Domas went to work for Intel and has been quiet ever since...

 

There's a reason IOT is scorned upon in the information security sector.  If it doesn't need to connect to the internet, it probably shouldn't.  I am greatly opposed to Apple and Amazon feeding internet connections to other devices they own if they don't have their own internet connection. 

Edited March 9 by Kaz
Fixed quote.

[schuck6566]

  On 09/03/2025 at 06:24, Kaz said:

 

Undocumented "backdoor" found in Bluetooth chip used by a billion devices

WWW.BLEEPINGCOMPUTER.COM

---

The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an...

 

This feeds into what Christopher Domas was saying about the concerns of hardware back doors and the potential for hidden commands.  It's why the U.S. developed the Chips and Science Act to subsidize chip manufacturing in the US.  I don't think hardware designers are done trying to backdoor their equipment.

 

Domas went to work for Intel and has been quiet ever since...

 

There's a reason IOT is scorned upon in the information security sector.  If it doesn't need to connect to the internet, it probably shouldn't.  I am greatly opposed to Apple and Amazon feeding internet connections to other devices they own if they don't have their own internet connection. 

Expand  

The last thing I should have to do is turn off the option to connect to wireless devices that are in reach but not currently connected to my network. That option is on by default with Amazon. WHY would I even want to create a connection to some wireless printer in my apt building that I have no clue who owns it?Why would I let other devices randomly connect to the Internet with my service?