ESP32 and the security risk from hidden instructions
A security research group has just discovered undisclosed instructions on the ESP32 microcontroller, one of the most popular chips used in IoT devices globally. According to experts, these special instructions could be exploited to access device memory and manipulate Bluetooth functions, posing a potential risk to system security. However, exploiting these instructions remotely is not simple and often requires physical access or previously compromised software.
The ESP32 microcontroller, manufactured by Espressif (China), is a vital component in mobile devices, computers, smart locks, and medical devices, supporting both Wi-Fi and Bluetooth connectivity. According to statistics, as of 2023, over 1 billion devices worldwide are using ESP32.
This discovery was announced by two Spanish security researchers, Miguel Tarascó Acuña and Antonio Vázquez Blanco from Tarlogic Security, at the RootedCON conference in Madrid. The research team identified 29 proprietary hidden instructions in the ESP32 Bluetooth firmware, including Opcode 0x3F, which allows low-level control over Bluetooth functions.
Although initially referred to as a “backdoor,” the research team later clarified that these instructions are actually hidden features that can be used to read and edit memory on the ESP32 microcontroller. However, the existence of these instructions still raises concerns about supply chain attacks and the possibility of backdoors being implanted by Original Equipment Manufacturers (OEMs).
Security risks and exploitation methods
The existence of these undisclosed instructions could be exploited to read and write RAM and Flash memory, change MAC addresses to spoof devices, or inject LMP/LLCP packets. While these features themselves may not have malicious intent, in the hands of an attacker, they could be used to spoof devices, bypass security checks, or permanently alter device behavior.
A unique tool to audit the security of the Bluetooth standard on any IoT device. Miguel Tarascó and @antonvblanco are presenting #BluetoothUSB at @rootedcon. pic.twitter.com/hsCFCWOCuB
— Tarlogic (@Tarlogic) March 6, 2025
The risk of these instructions primarily depends on the attack vector. In most cases, remote exploitation requires an accompanying security vulnerability, such as pre-installed malware or compromised firmware. A more realistic attack scenario would involve an attacker having physical access to the device’s USB or UART ports, allowing for direct manipulation.
To analyze and identify these hidden instructions, the Tarlogic research team developed BluetoothUSB – a new C-based Bluetooth driver that helps retrieve Bluetooth data without relying on the operating system’s API. This tool allows for comprehensive security testing on Bluetooth devices without the need for specialized hardware, overcoming the limitations of traditional security tools which are restricted by the operating system.
With the widespread popularity of ESP32 in low-cost IoT devices (starting from as low as $2 USD), this discovery serves as an important reminder of the significance of firmware security. Although these hidden instructions may have originally been designed to support debugging and development, their existence poses a major challenge to IoT system security in the future.
