On: Espressif's Response to Undocumented Commands in ESP32 Bluetooth by Tarlogic

[ixau]

One of the issues here (pointed by the authors) is supply chain attack.

You order 100k chips for your products and while in transit they get compromised by a this party via the said commands

In any case either it is gross incompetence or deliberate malice.

[unsnap_biceps → ixau]

Why does that matter at all? There's no persistence granted by the debug commands. When you flash it with your firmware, it's clean. If you trust the firmware that ships, they can do arbitrary code in it, so why care about a few debug interfaces?

[red-iron-pine → unsnap_biceps]

why does a supply chain attack matter? ITT we don't understand supply chains.

let's ask a few Hezbollah types about their pagers...

[ajross → red-iron-pine]

You're not responding to the full statement. Grandparent was saying that a supply chain attack is not possible with this exploit ("exploit", I guess -- again there's no security boundary being crossed here), not that supply chain attacks don't matter in the abstract.

[ajross → ixau]

There was no such attack demonstrated. The debug commands operate on the memory of the running BTLE controller. They can't be used to modify persistent firmware.