Undocumented commands found in Bluetooth chip used by a billion devices
www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices
What Jamie wrote
This article caught my eye because of the security threat. However, when I saw the company name Espressif, I knew I had seen it before. Looking in my UniFi console I see I have one of these devices on my network!
You know how in movies they always have these scenes where the tech person plugs a little dongle into a computer and in 5 seconds has control of the entire thing. Or they even just stand by it and do that? This is when technologists roll their eyes and mutter "it doesn't work like that" under their breath.
Except this backdoor shows maybe it could, or does.
The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains undocumented commands that could be leveraged for attacks.
The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence.
Testing chips to see if they do what they say they do is straightforward. Testing chips to see if they do anything else? That is ridiculously hard if not impossible.
Tarlogic developed a new C-based USB Bluetooth driver that is hardware-independent and cross-platform, allowing direct access to the hardware without relying on OS-specific APIs.
None of this is even possible to exploit via the operating systems themselves.