Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ESP32 Undocumented Bluetooth Commands: Clearing the Air

developer.espressif.com

Post reply on HN
Print view View original

71–80 of 92 posts

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#71

Post by ExoticPearTree »

roger_ wrote: post #68
akx wrote: post #55

Earlier quoted context omitted.

You left out the important part of that sentence. > Espressif will provide a fix that removes access to these HCI debug commands through a software patch for currently supported ESP-IDF versions ESP-IDF is the "SDK" for these chips – I read that as "you'll get a new function that you call to disable these commands until you reset the chip, to limit attack surface for the rest of your app".

I guess it could either mean “the patch will remove access to those commands” or “the patch will add the ability to disable those commands”.

Lost in translation.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#72

Post by ExoticPearTree »

atoav wrote: post #10
rswail wrote: post #4

In other words, this was a beatup for internet points, not, in any way, an actual security issue.

If their goal was to get espressif to explain undocumented functionality they reached it. And espressif should have closed that gap without external pressure.

> And espressif should have closed that gap without external pressure.

There is a possibility it did not cross their minds that those instructions could an issue.

In their blog post they were very open about what does commands do and it looks like some of their clients that do advanced things with their chips are also aware of the instructions.

Probably the idea that the company is Chinese was enough to not bother asking the manufacturer for documentation about the instructions.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#73

Post by mystified5016 »

Crosseye_Jack wrote: post #43
looofooo0 wrote: post #36

Earlier quoted context omitted.

It is a relative small company which is catering the DIY market. To build any substantial user base with industrial applications, I guess their way is to continue to be open and enable people to build DIY stuff and a tiny fraction of these will one day build products with ESP chips inside.

I've in no way surveyed the whole wifi mcu market. But wasn't the "beginnings" of Espressif in the western world that it was a cheap wifi mcu that was at the time very popular in cheap Chinese wifi enabled products. The DIY market (at least in the west) came later. I still remember reading the hackaday article about them being discovered back in the day - https://hackaday.com/2014/08/26/new-chip-alert-the-esp8266-w..…

The biggest factor (IMO) is that during the pandemic chip shortages, about the only WiFi/BT module in stock anywhere was espressif. They consistently had stock when no one else did, so a lot of home hackers got into it.

As our industry is so fond of forgetting and rediscovering, if your product is easy and accessible to home hackers, it will be used in those hackers' real jobs.

But also they're so goddamn cheap. Espressif somehow scaled production super fast and got the price way below any of the competition.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#74

Post by mystified5016 »

tw04 wrote: post #54
looofooo0 wrote: post #36

Earlier quoted context omitted.

It is a relative small company which is catering the DIY market. To build any substantial user base with industrial applications, I guess their way is to continue to be open and enable people to build DIY stuff and a tiny fraction of these will one day build products with ESP chips inside.

> It is a relative small company which is catering the DIY market. Is that really all it is? I’ve got multiple IOT devices from major vendors that use esp32. I’ve also seen multiple EV chargers that leverage the platform.

Tale as old as time. If your product is DIY accessible, it will eventually become some engineer's favorite tool and they use it at work.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#75

Post by mystified5016 »

spaintech wrote: post #15

First and foremost, I have no affiliation with any of the authors previously mentioned. However, I would like to pose a question to the community: Is it feasible to exploit these undocumented HCI commands to develop malicious firmware for the ESP32? Such firmware could potentially be designed to respond to over-the-air (OTA) signals, activating these hidden commands to perform unauthorized actions like memory manipul…

No.

It is literally just a debug port exposed over the wired HCI interface.

This gives you absolutely nothing at all that you can't get with a normal UART debug port or JTAG. Everything in the HCI commands already exists in the normal bootloader. If you can get a device into bootloader mode, you can peek and poke flash and memory, along with everything else.

There is absolutely nothing here.

You can create malicious firmware, sure, but it has nothing to do with this HCI thing.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#76

Post by mystified5016 »

blitzar wrote: post #37
ElectRabbit wrote: post #12

Earlier quoted context omitted.

On the HCI interface. That's not a OTA attack. If an attacker can write raw data the HCI interface you are doomed anyway.

If you have access to the targets computer and their password there is an attack vector where you can feasibly gain access their files.

If and only if the host's serial or HCI driver has some undocumented exploit to gain code execution. (They probably don't)

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#77

Post by roger_ »

akx wrote: post #70
roger_ wrote: post #68

Earlier quoted context omitted.

I guess it could either mean “the patch will remove access to those commands” or “the patch will add the ability to disable those commands”.

The researcher-or-tinkerer who wants to play with these commands can just not upgrade to the newer ESP-IDF. Or update to a newer ESP-IDF, and revert the patch. It's open source. https://github.com/espressif/esp-idf

Yeah but getting stuck on an old version of ESP-IDF is annoying.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#78

Post by stogot »

pjc50 wrote: post #18
sschueller wrote: post #9

You should be switching off the bluetooth on your device if is not needed. CE also has some regulations regarding this. I use the ESP32 in my product[1] I am glad they exist. Their per-certified modules save you quite a bit of money when you do your CE testing. Espressif also offer free design review if you are using their chip in your commercial project/product[2]. [1] https://www.stationdisplay.com/ [2] https://www…

> CE also has some regulations regarding this. Which part of CE? One of the ETSI standards?

What is CE?

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#79

Post by sschueller »

stogot wrote: post #78
pjc50 wrote: post #18

Earlier quoted context omitted.

> CE also has some regulations regarding this. Which part of CE? One of the ETSI standards?

What is CE?

https://europa.eu/youreurope/business/product-requirements/l...

Like FCC with extras but for the European region.

Re: ESP32 Undocumented Bluetooth Commands: Clearing the Air

#80

Post by kelnos »

1oooqooq wrote: post #50
rswail wrote: post #4

In other words, this was a beatup for internet points, not, in any way, an actual security issue.

How you think always-open debug is NOT a security issue? The blog post is a "nothing to see here". You really fell for it? Do we still do car analogies? Here's this car with just a ignition button without keys, and keys to your home in the glovebox and the address already on the GPS... but the thief would have to break into the car first!

There's nothing to "fall for". Do you have specific evidence that refutes Espressif's rationale for why they believe it's not a security issue. No, a flawed car analogy doesn't count.

If you can break into the application running on an ESP32, you already have full access to RAM etc. The debug HCI commands will not give you any extra access.

Yes, security researchers are incentivized to make issues seem like more of a problem than they are, and vendors are incentivized to minimize them. In this case, though, the reality is much closer to Espressif's version.

Post reply on HN