Technology

Seriously this. Every single IC which has digital logic contains some number of undocumented test commands used to ensure it meets all the required specifications during production. They're not intended to be used for normal operation and almost never included in datasheets.

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

Code execution required lmao

It’s because the security company basically lied about this being a vulnerability, and probably opened themselves up to a lawsuit.

It's a vulnerability where an attacker already needs code execution on the device/physical access.

If you have that you're already compromised no matter what.

The issue is where the undocumented commands are. They aren't just allowing any old external person to send payloads to this.

It's kind of like noticing that someone unexpectedly hid a spare key next to the door... On the inside of the house. Like, sure, maybe the owner would have like to know about that key, but since you have to be inside the house to get to it, it doesn't really make a difference.

Because that's not about privacy, that's about the trade war. Retaliatory tariffs on US cars increase cost of cars for Canadians, as there are almost no car assembled in Canada. Reducing or eliminating tariffs on cars from China would lower cost of new cars for Canadians while keeping the tariffs up.

For privacy and security, not a single new car on the market is decent right now. That should be regulated, but that's no concern for any politician at the moment.

Its not a backdoor, you're most likely fine.

Go for it. It’s a bullshit attention grab. No backdoor, just some undocumented vendor commands (which is the norm for virtually every chip out there).

The exploit requires physical access. It's not exploitable in 99% of cases

Or use a precise title. It's not a backdoor or a "backdoor".

Here’s an article with a bit more detail… but I’m still unclear whether these backdoor commands are hardware circuits or firmware logic.

Bleeping Computer: Undocumented "backdoor" found in Bluetooth chip used by a billion devices

Say it ain't so
Your bug is a heartbleeder
Say it ain't so
My NIC is a bytetaker