{
  "id": "644cf028bda8",
  "url": "https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/",
  "title": "Undocumented commands found in Bluetooth chip used by a billion devices",
  "note": "This article caught my eye because of the security threat. However, when I saw the company name Espressif, I knew I had seen it before. Looking in my UniFi console I see I have one of these devices on my network!\n\nYou know how in movies they always have these scenes where the tech person plugs a little dongle into a computer and in 5 seconds has control of the entire thing. Or they even just stand by it and do that? This is when technologists roll their eyes and mutter \"it doesn't work like that\" under their breath.\n\nExcept this backdoor shows maybe it could, or does. \n\n> The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains undocumented commands that could be leveraged for attacks.\n> \n> The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence.\n\nTesting chips to see if they do what they say they do is straightforward. Testing chips to see if they do anything else? That is ridiculously hard if not impossible.\n\n> Tarlogic developed a new C-based USB Bluetooth driver that is hardware-independent and cross-platform, allowing direct access to the hardware without relying on OS-specific APIs.\n\nNone of this is even possible to exploit via the operating systems themselves.\n",
  "voice": "mixed",
  "saved": "2025-03-10T12:06:09Z",
  "host": "bleepingcomputer.com",
  "kind": "page",
  "tags": [],
  "record": "https://links.thingelstad.xyz/links/644cf028bda8/",
  "markdown": "https://links.thingelstad.xyz/links/644cf028bda8.md",
  "issues": [
    {
      "number": 313,
      "slug": "313",
      "title": "Weekly Thing 313 / Agentic, Shadows, WireMock",
      "date": "2025-03-15T15:08:33.653855Z",
      "section": "Notable",
      "position": 2,
      "url": "https://weekly.thingelstad.com/archive/313/",
      "page": "https://links.thingelstad.xyz/issues/313/"
    }
  ],
  "connections": {
    "same_host": {
      "count": 3,
      "page": "https://links.thingelstad.xyz/hosts/bleepingcomputer.com/",
      "nearest": [
        {
          "id": "a45ebae52157",
          "title": "Russia creates its own TLS certificate authority to bypass sanctions",
          "url": "https://www.bleepingcomputer.com/news/security/russia-creates-its-own-tls-certificate-authority-to-bypass-sanctions/",
          "record": "https://links.thingelstad.xyz/links/a45ebae52157/"
        },
        {
          "id": "b76664786873",
          "title": "Internet Archive hacked, data breach impacts 31 million users",
          "url": "https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/",
          "record": "https://links.thingelstad.xyz/links/b76664786873/"
        },
        {
          "id": "eae15479f667",
          "title": "Internet Archive breached again through stolen access tokens",
          "url": "https://www.bleepingcomputer.com/news/security/internet-archive-breached-again-through-stolen-access-tokens/",
          "record": "https://links.thingelstad.xyz/links/eae15479f667/"
        }
      ]
    },
    "same_week": {
      "count": 26,
      "nearest": [
        {
          "id": "4af03601bd29",
          "title": "🔭 The Einstein AI model",
          "url": "https://thomwolf.io/blog/scientific-ai.html",
          "record": "https://links.thingelstad.xyz/links/4af03601bd29/"
        },
        {
          "id": "17ff46041d04",
          "title": "Age and cognitive skills: Use it or lose it | Science Advances",
          "url": "https://www.science.org/doi/full/10.1126/sciadv.ads1560?af=R",
          "record": "https://links.thingelstad.xyz/links/17ff46041d04/"
        },
        {
          "id": "2f56bef7975d",
          "title": "Yessica's Pencils | David O'Hara",
          "url": "https://davoh.org/2025/03/09/yessicas-pencils.html",
          "record": "https://links.thingelstad.xyz/links/2f56bef7975d/"
        },
        {
          "id": "92db164fa193",
          "title": "WireMock - flexible, open source API mocking",
          "url": "https://wiremock.org/",
          "record": "https://links.thingelstad.xyz/links/92db164fa193/"
        },
        {
          "id": "74bfb0d65afe",
          "title": "H3",
          "url": "https://h3geo.org/",
          "record": "https://links.thingelstad.xyz/links/74bfb0d65afe/"
        }
      ]
    },
    "mentions": [],
    "mentioned_by": [],
    "saved_twice": []
  },
  "elsewhere": {
    "wayback": "https://web.archive.org/web/*/https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/"
  }
}