Technology

Code execution required lmao

Come through with what though?

Seriously this. Every single IC which has digital logic contains some number of undocumented test commands used to ensure it meets all the required specifications during production. They're not intended to be used for normal operation and almost never included in datasheets.

It's a vulnerability where an attacker already needs code execution on the device/physical access.

If you have that you're already compromised no matter what.

The issue is where the undocumented commands are. They aren't just allowing any old external person to send payloads to this.

It's kind of like noticing that someone unexpectedly hid a spare key next to the door... On the inside of the house. Like, sure, maybe the owner would have like to know about that key, but since you have to be inside the house to get to it, it doesn't really make a difference.

I was reading someone else's explanation and they said it's the equivalent of every computer possibly having a backdoor because there is code in a computer that a bad actor can use. There are extra commands that could possibly be used for a backdoor if a malicious actor found a way to use those bits of code. It's much less oh here is a security vulnerability that is being used and more of a if a robber breaks into our house which is possible they will rob us situation.

It’s because the security company basically lied about this being a vulnerability, and probably opened themselves up to a lawsuit.

Yeah, one of those is factually correct and got upvoted...

You're kidding, right?

Or use a precise title. It's not a backdoor or a "backdoor".

Go for it. It’s a bullshit attention grab. No backdoor, just some undocumented vendor commands (which is the norm for virtually every chip out there).

The exploit requires physical access. It's not exploitable in 99% of cases

Its not a backdoor, you're most likely fine.

Open source stack will not prevent this. It's not even a backdoor, it's functionality that these researches think should be hidden from programmers for whatever reason.

Open source devices would have this functionality readily available for programmers. Look at rtl-sdr, using the words of these researches, it has a "backdoor" where a TV dongle may be used to listen to garage key fobs gasp everyone panic now!

I 100% believe firmware should be open source no question about it. There's so many devices out there especially phones and iot devices that just become e-waste because you can't do anything with it once it's not supported if it was open source and documented in some way then it could be used. I have like five cheap phones that I got because they were so cheap but once they lost support they've become completely useless even though they still work.

You're fine. This isn't something that can be exploited over wifi. You literally need physical access to the device to exploit it as it's commands over USB that allow flashing the chip.

This is a security firm making everything sound scary because they want you to buy their testing device.