# Undocumented commands found in Bluetooth chip used by a billion devices - Host: [bleepingcomputer.com](https://links.thingelstad.xyz/hosts/bleepingcomputer.com/) - Saved: March 10, 2025 (2025-03-10T12:06:09Z) - Record: https://links.thingelstad.xyz/links/644cf028bda8/ - JSON: https://links.thingelstad.xyz/links/644cf028bda8.json ## What Jamie wrote This article caught my eye because of the security threat. However, when I saw the company name Espressif, I knew I had seen it before. Looking in my UniFi console I see I have one of these devices on my network! You know how in movies they always have these scenes where the tech person plugs a little dongle into a computer and in 5 seconds has control of the entire thing. Or they even just stand by it and do that? This is when technologists roll their eyes and mutter "it doesn't work like that" under their breath. Except this backdoor shows maybe it could, or does. > The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains undocumented commands that could be leveraged for attacks. > > The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence. Testing chips to see if they do what they say they do is straightforward. Testing chips to see if they do anything else? That is ridiculously hard if not impossible. > Tarlogic developed a new C-based USB Bluetooth driver that is hardware-independent and cross-platform, allowing direct access to the hardware without relying on OS-specific APIs. None of this is even possible to exploit via the operating systems themselves. ## Facts - Kind: [Page](https://links.thingelstad.xyz/kinds/page/) ## Appears in - [WT313: Weekly Thing 313 / Agentic, Shadows, WireMock](https://weekly.thingelstad.com/archive/313/), Notable ## Same host - [Russia creates its own TLS certificate authority to bypass sanctions](https://links.thingelstad.xyz/links/a45ebae52157/) (bleepingcomputer.com, March 14, 2022) - [Internet Archive hacked, data breach impacts 31 million users](https://links.thingelstad.xyz/links/b76664786873/) (bleepingcomputer.com, October 10, 2024) - [Internet Archive breached again through stolen access tokens](https://links.thingelstad.xyz/links/eae15479f667/) (bleepingcomputer.com, October 24, 2024) ## Saved the same week - [🔭 The Einstein AI model](https://links.thingelstad.xyz/links/4af03601bd29/) (thomwolf.io, March 10, 2025) - [Age and cognitive skills: Use it or lose it | Science Advances](https://links.thingelstad.xyz/links/17ff46041d04/) (science.org, March 10, 2025) - [Yessica's Pencils | David O'Hara](https://links.thingelstad.xyz/links/2f56bef7975d/) (davoh.org, March 10, 2025) - [WireMock - flexible, open source API mocking](https://links.thingelstad.xyz/links/92db164fa193/) (wiremock.org, March 10, 2025) - [H3](https://links.thingelstad.xyz/links/74bfb0d65afe/) (h3geo.org, March 10, 2025) ## Elsewhere - Wayback Machine: https://web.archive.org/web/*/https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/