https://www.bleepingcomputer.com/news/security/undocumented-backdoor-found-in-bluetooth-chip-used-by-a-billion-devices/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Ransomware gang encrypted network from a webcam to bypass EDR Ransomware gang encrypted network from a webcam to bypass EDR + Microsoft: North Korean hackers join Qilin ransomware gang Microsoft: North Korean hackers join Qilin ransomware gang + Over 37,000 VMware ESXi servers vulnerable to ongoing attacks Over 37,000 VMware ESXi servers vulnerable to ongoing attacks + Microsoft says malvertising campaign impacted 1 million PCs Microsoft says malvertising campaign impacted 1 million PCs + Developer guilty of using kill switch to sabotage employer's systems Developer guilty of using kill switch to sabotage employer's systems + Undocumented Undocumented "backdoor" found in Bluetooth chip used by a billion devices + YouTubers extorted via copyright strikes to spread malware YouTubers extorted via copyright strikes to spread malware + This $15 CCleaner app helps clean unnecessary files from your PC This $15 CCleaner app helps clean unnecessary files from your PC * Tutorials + Latest + Popular + How to access the Dark Web using the Tor Browser How to access the Dark Web using the Tor Browser + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Undocumented "backdoor" found in Bluetooth chip used by a billion devices * * Undocumented "backdoor" found in Bluetooth chip used by a billion devices By Bill Toulas * March 8, 2025 * 11:12 AM * 2 ESP32 The ubiquitous ESP32 microchip made by Chinese manufacturer Espressif and used by over 1 billion units as of 2023 contains an undocumented "backdoor" that could be leveraged for attacks. The undocumented commands allow spoofing of trusted devices, unauthorized data access, pivoting to other devices on the network, and potentially establishing long-term persistence. This was discovered by Spanish researchers Miguel Tarasco Acuna and Antonio Vazquez Blanco of Tarlogic Security, who presented their findings yesterday at RootedCON in Madrid. "Tarlogic Security has detected a backdoor in the ESP32, a microcontroller that enables WiFi and Bluetooth connection and is present in millions of mass-market IoT devices," reads a Tarlogic announcement shared with BleepingComputer. "Exploitation of this backdoor would allow hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls." The researchers warned that ESP32 is one of the world's most widely used chips for Wi-Fi + Bluetooth connectivity in IoT (Internet of Things) devices, so the risk of any backdoor in them is significant. Slide from the RootedCON presentationSlide from the RootedCON presentation Source: Tarlogic Discovering a backdoor in ESP32 In their RootedCON presentation, the Tarlogic researchers explained that interest in Bluetooth security research has waned but not because the protocol or its implementation has become more secure. Instead, most attacks presented last year didn't have working tools, didn't work with generic hardware, and used outdated/unmaintained tools largely incompatible with modern systems. Tarlogic developed a new C-based USB Bluetooth driver that is hardware-independent and cross-platform, allowing direct access to the hardware without relying on OS-specific APIs. Armed with this new tool, which enables raw access to Bluetooth traffic, Targolic discovered hidden vendor-specific commands (Opcode 0x3F) in the ESP32 Bluetooth firmware that allow low-level control over Bluetooth functions. ESP32 memory mapESP32 memory map Source: Tarlogic In total, they found 29 undocumented commands, collectively characterized as a "backdoor," that could be used for memory manipulation (read/write RAM and Flash), MAC address spoofing (device impersonation), and LMP/LLCP packet injection. Espressif has not publicly documented these commands, so either they weren't meant to be accessible, or they were left in by mistake. Script that issues HCI commandsScript that issues HCI commands Source: Tarlogic The risks arising from these commands include malicious implementations on the OEM level and supply chain attacks. Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections. This is especially the case if an attacker already has root access, planted malware, or pushed a malicious update on the device that opens up low-level access. In general, though, physical access to the device's USB or UART interface would be far riskier and a more realistic attack scenario. "In a context where you can compromise an IOT device with as ESP32 you will be able to hide an APT inside the ESP memory and perform Bluetooth (or Wi-Fi) attacks against other devices, while controlling the device over Wi-Fi/Bluetooth," explained the researchers to BleepingComputer. "Our findings would allow to fully take control over the ESP32 chips and to gain persistence in the chip via commands that allow for RAM and Flash modification." "Also, with persistence in the chip, it may be possible to spread to other devices because the ESP32 allows for the execution of advanced Bluetooth attacks." BleepingComputer has contacted Espressif for a statement on the researchers' findings, but a comment wasn't immediately available. Update 3/8/25: Added statement from Tarlogic. Related Articles: Privacy tech firms warn France's encryption and VPN laws threaten privacy New Auto-Color Linux backdoor targets North American govts, universities Zyxel won't patch newly exploited flaws in end-of-life routers Backdoor found in two healthcare patient monitors, linked to IP in China Chinese cyberspies use new SSH backdoor in network device hacks * Backdoor * Bluetooth * Chips * ESP32 * Hardware * * * * * Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. * Previous Article * Next Article Comments * h_b_s Photo h_b_s - 5 hours ago + + Looks to be another case where hardware debug instructions were left exposed in the final product for whatever reason. Once you have developed a driver you can gain remote access by other means, trigger your privilege elevation and drop your substitute ESP32 driver in place for whatever shennanigans you intend. There's no easy fix to this without replacing all ESP32 hardware, assuming Espressif bothers with a fixed hardware revision, OEMs issue a recall, and users even know they have a proverbial time bomb waiting for bot-net inclusion or network pivot. It's a practical guarantee that the vast majority of people and organizations aren't even aware of the chip sets in all the IoT devices present in their home or physical plant. * superSun Photo superSun - 5 hours ago + + This is very distorted information. First, the undocumented commands, it is not the "backdoor". It is very common that software/firmware and hardware product has undocumented commands that is how product works..it is for the manufacturer designing and debugging products needs Secondly, Bluetooth is very short distance communication for ESP32 chip, the communication distance is less than 10 meters. If you want to hack the home appliance, you must stay in the premise, you can manually turn on/off. It does not work hacker remotely in anywhere. So, your device is very safe for the Bluetooth driver flaw Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] acronis Popular Stories * Webcam Ransomware gang encrypted network from a webcam to bypass EDR * Chrome flare Malicious Chrome extensions can spoof password managers in new attack * VMware Over 37,000 VMware ESXi servers vulnerable to ongoing attacks Sponsor Posts * SharpRhino resurfaces: How this malware evades detection. See how it works. * The vCISO Academy: Transforming MSPs and MSSPs into Cybersecurity Powerhouses * 5 Browser Security Threats Overlooked by Security Tools. Get the Free Report * Overdue a password health-check? Audit your Active Directory for free * Integrating LLMs into security operations using Wazuh. Learn how to get started. Follow us: * * * * * Main Sections * News * VPN Buyer Guides * SysAdmin Software Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT