In what way is what you quoted not describing an RCE?
Clearly there are unanswered questions like does this malicious firmware exist? and how likely is it that ESP32s in the wild were shipped with it?
But they’re still describing an RCE.
Clearly there are unanswered questions like does this malicious firmware exist? and how likely is it that ESP32s in the wild were shipped with it?
But they’re still describing an RCE.
The fact that it might be necessary to execute these commands locally is separate from the effects of executing those commands and the potential implications for hardware in the wild.
A simple example would be a supply chain attack that leverages these commands to compromise what will soon be consumer hardware.
If someone just discovered nc in the wild and up to that point it had been unknown, people would put that bit of software in a very different category than the one it exists in today.
Quick, before someone posts this to Mastodon and gives presentation at security conference with title:
Living off the Land: the Hidden Threat Within
ESP32 devices not using the Bluetooth adapter firmware are unaffected and already running custom closed source (possibly encrypted) code from the supplier.
The reason it's not important is that you require a physical connection to the target device. The exact same type of connection you use to program firmware in the first place.
The "backdoor" is just that there's now one additional way to program firmware with a physical connection to the chip. The only issue is it was never documented.
There's no potential for exploitation here. If you have physical access to a real serial port on one of these chips, you cab load your own firmware. That's it. That's the entire exploit.
It's meaningless nothing. It really only matters at all if you care about blocking unauthorized firmware updates over a wired serial connection. If you do care, there are options aplenty.
Malicious firmware is not a RCE. If you install a malicious firmware you can do all kinds of bad stuff without this undocumented behavior.
And "rogue Bluetooth connections" is entirely theoretical. That MIGHT be a RCE, but it is not one. More of a hypothesis.
The headline alludes to much more than they have actually demonstrated. I'll change my tune when they demo the exploit code.