4 ms·
That's about the right response. These don't expose a command across a security boundary. You can only exercise them if you're already executing arbitary code
by ajross 2y ago
That's about the right response. These don't expose a command across a security boundary. You can only exercise them if you're already executing arbitary code on the main CPU core.
Honestly the original Tarlogic report was so irresponsible that I have to wonder if Espressif is considering legal action.
Note btw that the linked press release points to the more detailed blog post explaining the architecture: https://developer.espressif.com/blog/2025/03/esp32-bluetooth-clearing-the-air/ https://developer.espressif.com/blog/2025/03/esp32-bluetooth...
- runjake 2y ago> I have to wonder if Espressif is considering legal action. As the article says, they worked with Tarlogic to provide a correction. So, probably not. https://www.tarlogic.com/news/hidden-feature-esp32-chip-infect-ot-devices/ https://www.tarlogic.com/news/hidden-feature-esp32-chip-infe...
- ixau 2y agoOne of the issues here (pointed by the authors) is supply chain attack. You order 100k chips for your products and while in transit they get compromised by a this party via the said commands In any case either it is gross incompetence or deliberate malice.
- unsnap_biceps 2y agoWhy does that matter at all? There's no persistence granted by the debug commands. When you flash it with your firmware, it's clean. If you trust the firmware that ships, they can do arbitrary code in it, so why care about a few debug interfaces?
- red-iron-pine 2y agowhy does a supply chain attack matter? ITT we don't understand supply chains. let's ask a few Hezbollah types about their pagers...
- ajross 2y agoYou're not responding to the full statement. Grandparent was saying that a supply chain attack is not possible with this exploit ("exploit", I guess -- again there's no security boundary being crossed here), not that supply chain attacks don't matter in the abstract.
- ajross 2y agoThere was no such attack demonstrated. The debug commands operate on the memory of the running BTLE controller. They can't be used to modify persistent firmware.