- Security researchers Tarlogic found a hidden feature in ESPC32 Bluetooth -chip
- The affordable chip is found in millions of domestic IoT -Units all over the world
- The error enabled malicious actors to access devices and sensitive data that came through
A cheap Bluetooth chip that allegedly strengthens millions of Internet of Things (IoT) devices around the world has a “hidden feature” that gives those who know about running arbitrary commands, unlocking additional functionalities and even extracting sensitive information from the devices.
CyberSecurity scientists at Tarlogic have required ESPC32 chips that allow connection via WiFi or Bluetooth, “Hidden commands have not documented by the manufacturer.”
“These commands would allow you to change chips arbitrarily to unlock additional functionalities, infect these chips with malicious code and even perform attacks of identity theft of devices,” they said.
Obtain confidential information
The ESP32 chip is built by a Chinese semiconductor company headquartered in Shanghai, called Espressif. It costs about $ 2 per day. Unit and according to the manufacturer is sold a billion times from the start to 2023.
Tarlogic says its affordable prices are one of the main reasons why it is so often found in Bluetooth IoT units for household.
Tarlogic first described the conclusions as a “back door”, but later drawn on this terminology: “We would like to clarify that it is more appropriate to refer to the presence of proprietary HCI commands – which allows operations such as reading and changing memory in the ESP32 controller – as a” hidden function “rather than a” back door. “, Said it.
Style, threat actors could use these commands to run supply chain attacks, hide the back door in the chipset or perform more sophisticated attacks, added Tarlogic. They could mimic well -known devices to connect to mobile phones, computers and smart devices, even when in offline mode.
Tarlogic said the purpose is, “To get confidential information stored on them, to have access to personal and business interviews and to spy on citizens and businesses.”
We have reached Espressif for a comment and will update the article if we hear back.
