Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Timely post with the vulnerability research this week? https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-...


This outfit has changed the term "backdoor" to mean "any undocumented feature". The findings reported are absolutely not a backdoor in any conventional usage of the term. One would need to flash their own code to the micro to make use of these features, which is the normal operating mode for any micro device.

This is nothing other than a security research team trying to get some attention by crying wolf.


That was related to Bluetooth. Interesting undocumented low level commands but it's a bit of a stretch to call it a vulnerability IMHO.

But having the whole stack open would just be better in general.


Correct. HN thread https://news.ycombinator.com/item?id=43301369

Not a vulnerability in the way that Tarlogic makes it sound. Disingenuous and misleading article for sure.


A good bunch of "security" articles that make the news look more like scareware to me in the past years.


This isn't a backdoor, it's just an undocumented debugger in the HCI stack. You still need a physical UART connection to the device AFAIK. The exact same type of connection you use to program and debug the device normally.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: