Conversation

Notices

1. Embed this notice
   jiska 🦄:fairydust: (jiska@chaos.social)'s status on Monday, 10-Mar-2025 02:07:42 JST jiska 🦄:fairydust:

   Tarlogic found a "backdoor" in the ESP32 chips: https://social.lansky.name/@hn100/114127956134801350

   Broadcom and Cypress chips have the same HCI "backdoor" allowing to write to the Bluetooth chip's RAM. This feature is used for firmware patches.

   We didn't request CVEs for that 9 years ago. Instead, we built the InternalBlue Bluetooth research framework: https://github.com/seemoo-lab/internalblue

   • Jesse 🇫🇷 repeated this.
   • Embed this notice
     jiska 🦄:fairydust: (jiska@chaos.social)'s status on Monday, 10-Mar-2025 03:16:34 JST jiska 🦄:fairydust:

     in reply to

     Firmware memory access through HCI was never considered a threat, since an attacker requires at least code execution in the Bluetooth daemon/driver for getting code execution in the Bluetooth firmware.

     This threat model changed slightly when we showed further privilege escalation, in particular code execution in the WiFi firmware via Bluetooth. Now, this interface is only available until Bluetooth firmware patches were applied at driver/daemon initialization.

     https://arxiv.org/pdf/2112.05719