5 ms·

Timely post with the vulnerability research this week? https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/ https://www.tarlogic.com/news/backd

• dugite-code 2y ago
  That was related to Bluetooth. Interesting undocumented low level commands but it's a bit of a stretch to call it a vulnerability IMHO. But having the whole stack open would just be better in general.
  • gibibit 2y ago
    Correct. HN thread https://news.ycombinator.com/item?id=43301369 https://news.ycombinator.com/item?id=43301369 Not a vulnerability in the way that Tarlogic makes it sound. Disingenuous and misleading article for sure.
    • nottorp 2y ago
      A good bunch of "security" articles that make the news look more like scareware to me in the past years.
• luma 2y ago
  This outfit has changed the term "backdoor" to mean "any undocumented feature". The findings reported are absolutely not a backdoor in any conventional usage of the term. One would need to flash their own code to the micro to make use of these features, which is the normal operating mode for any micro device. This is nothing other than a security research team trying to get some attention by crying wolf.
• mystified5016 2y ago
  This isn't a backdoor, it's just an undocumented debugger in the HCI stack. You still need a physical UART connection to the device AFAIK. The exact same type of connection you use to program and debug the device normally.