A potential security issue has been discovered by cybersecurity researchers that has the capability to affect more than one billion devices.
According to researchers at the cybersecurity firm Tarlogic997 Archives a hidden command has been foundcoded into a bluetooth chip installed in devices around the world. This secret functionality can be weaponized by bad actors and, according to the researchers, used as an exploit into these devices.
Using these commands, hackers could impersonate a trusted device and then connect to smartphones, computers, and other devices in order to access information stored on them. Bad actors can continue to utilize their connection to the device to essentially spy on users.
The bluetooth chip is called ESP32 and is manufactured by the China-based company Espressif. According to researchers, the ESP32 is "a microcontroller that enables WiFi and Bluetooth connection." In 2023, Espressif reported that one billion units of its ESP32 chip had been sold globally. Millions of IoT devices like smart appliances utilize this particular ESP32 chip.
Tarlogic researchers say that this hidden command could be exploited, which would allow "hostile actors to conduct impersonation attacks and permanently infect sensitive devices such as mobile phones, computers, smart locks or medical equipment by bypassing code audit controls." Tarlogic says that these commands are not publicly documented by Espressif.
Researchers with Tarlogic developed a new Bluetooth driver tool in order to aid in Bluetooth-related security research, which enabled the security firm to discover a total of 29 hidden functionalities that could be exploited to impersonate known devices and access confidential information stored on a device.
According to Tarlogic, Espressif sells these bluetooth chips for roughly $2, which explains why so many devices utilize the component over higher costing options.
As BleepingComputerreports, the issue is being tracked as CVE-2025-27840.
Topics Bluetooth Cybersecurity
Hidden Siri Commands and Unusual Responses
Announcing Our Spring Issue by Emily Stokes
Notes on Nevada: Trans Literature and the Early Internet by Imogen Binnie
Redux: Another Drink by The Paris Review
Mac Mini M2 Desktop deal: Save $100 at Best Buy
Redux: All the Green Things Writhing by The Paris Review
Worm Moon by Nina MacLaughlin
On Liberated Women Looking for Love by The Paris Review
SpaceX's BFR has a new name. Elon Musk is calling it Starship.
Venice Dispatch: from the Biennale by Olivia Kan
One of Android's Easter Eggs is a Flappy Bird
Notes on Nevada: Trans Literature and the Early Internet by Imogen Binnie
Redux: Couples at Work by The Paris Review
Redux: Conceptual Baggage by The Paris Review
Turtle Beach Recon 50P gaming headset deal: 28% off
Remembering Richard Howard by Craig Morgan Teicher
Two in the Afternoon by Mieko Kawakami
Redux: Like No One Else by The Paris Review
Against Fear
Redux: The Marketing of Obsession by The Paris Review
Is Robert Frost Even a Good Poet? by Jessica LaserCruising at the LA Fitness by Danez SmithDyson Airstrait deal: $100 off for Best Buy Plus & Total membersRabelaisian Enumerations: On Lists by Andrew HuiMaking of a Poem: Nora Fulton on “La ComédieGlimmer: In Siena by Cynthia ZarinSuper Bowl 2024 performers: Who is singing the anthems?Air fryer Super Bowl recipes: Wings, pigs in a blanket, fries, and moreTrump's climate order puts 'China first' in clean energyLove, Beyond Recognition by Benjamin EhrlichAI robocalls are officially illegal, FCC declaresMashTalk: Samsung's Galaxy S8 is here, but does it live up to all the hype?Chiefs vs 49ers livestream: How to watch the big game for freeWho are the 2024 Super Bowl referee, judges?On Najwan Darwish by Alexia UnderwoodBest Xbox game deal: Get 'Alan Wake II' for $12 off at XboxYour political views help determine which science books you buyNew Poetry: Margaret Ross, Nora Claire Miller, and Richie Hofmann Recommend by The Paris ReviewOpenAI, Google, Microsoft and others join the BidenThere and back: Elon Musk's SpaceX makes history with epic rocket launch and landing NYT Connections Sports Edition hints and answers for November 21: Tips to solve Connections #59 Microsoft and HarperCollins strike licensing deal to train AI models on nonfiction books How to use AirPods Pro as hearing aids Youtube Music 2024 recap: How to get yours Best iPad Black Friday deal: Save $70 on the 10th Gen iPad Best Black Friday smart speaker deal: Save over 50% on Amazon Echo Dot Best Black Friday smart device deal: Save $70 on Amazon Echo Show 8 Best Black Friday TV deal: Save $500 on the Hisense 65 Cambridge Dictionary's word of the year is 'manifest' Steelers vs. Browns 2024 livestream: How to watch Thursday Night Football for free France vs. Argentina 2024 livestream: Watch Autumn Internationals for free Best Mac deal: Get an M4 Mac Mini for $499.99 at Costco Players Championship Finals 2024 livestream: Watch live darts for free Shop early Black Friday deals on Kindles Early Black Friday MacBook deals 2024 Wordle today: The answer and hints for November 20 Today's Hurdle hints and answers for November 21 Best Black Friday Apple AirPods Max deal: Save $50 on Amazon Best Black Friday TV deal: Save $250 on the 75 'Silo' Season 2, episode 2: What happened between Bernard and Judge Meadows?