Espressif's Response to Undocumented Commands in ESP32 Bluetooth by Tarlogic

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by ajross on Tuesday March 11, 2025 @02:56PM (#43335839)

That's about the right response. These don't expose a command across a security boundary. You can only exercise them if you're already executing arbitary code on the main CPU core.

Honestly the original Tarlogic report was so irresponsible that I have to wonder if Espressif is considering legal action.

Note btw that the linked press release points to the more detailed blog post explaining the architecture: https://developer.espressif.com/blog/2025/03/esp32-bluetooth...

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by runjake on Tuesday March 11, 2025 @03:50PM (#43336358)

> I have to wonder if Espressif is considering legal action.

As the article says, they worked with Tarlogic to provide a correction. So, probably not.

https://www.tarlogic.com/news/hidden-feature-esp32-chip-infe...

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by ixau on Tuesday March 11, 2025 @05:19PM (#43337106)

One of the issues here (pointed by the authors) is supply chain attack.

You order 100k chips for your products and while in transit they get compromised by a this party via the said commands

In any case either it is gross incompetence or deliberate malice.

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by unsnap_biceps on Tuesday March 11, 2025 @05:23PM (#43337146)

Why does that matter at all? There's no persistence granted by the debug commands. When you flash it with your firmware, it's clean. If you trust the firmware that ships, they can do arbitrary code in it, so why care about a few debug interfaces?

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by red-iron-pine on Wednesday March 12, 2025 @11:56AM (#43344566)

why does a supply chain attack matter? ITT we don't understand supply chains.

let's ask a few Hezbollah types about their pagers...

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by ajross on Wednesday March 12, 2025 @12:03PM (#43344658)

You're not responding to the full statement. Grandparent was saying that a supply chain attack is not possible with this exploit ("exploit", I guess -- again there's no security boundary being crossed here), not that supply chain attacks don't matter in the abstract.

[ Parent | on HN ]

Re:Espressif's Response to Undocumented Commands in ESP32 Bl... by ajross on Tuesday March 11, 2025 @06:37PM (#43337856)

There was no such attack demonstrated. The debug commands operate on the memory of the running BTLE controller. They can't be used to modify persistent firmware.

[ Parent | on HN ]