Tarlogic Blog
tarlogic.com · Company blog · on HN since 2017
Tarlogic is a Spanish cybersecurity firm that publishes research on hardware backdoors, Kerberos attacks, fuzzing, and blockchain attacks.
What HN saysHN links it for the ESP32 'backdoor' report; commenters note that the undocumented commands were later seen as a nothingburger and that Espressif worked on a correction.
17HN people shared it
7linked it in comments
11stories submitted
42story points
2 years agolast shared
2017people per year2026
Most-shared posts
- 1Backdoor detected in ESP32 Espressif IoT chip4 people · 25 points · first shared 2025 · 12 comments on HN
- 2Linux process infection – Tarlogic Security2 people · 6 points · first shared 2018 · discussion on HN
- 3France and Economic Intelligence (2019)2 people · 1 points · first shared 2023 · discussion on HN
- 4Hidden feature esp32 chip infect ot devices2 people · first shared 2025
- 5Tracking Ethereum blockchain attackers: Measuring sandwich attacks1 people · 2 points · first shared 2022 · discussion on HN
- 6Introduction to kerberos and kerberos-related attacks1 people · 2 points · first shared 2019 · discussion on HN
- 7Interactive Shell via BlueTooth1 people · 2 points · first shared 2018 · discussion on HN
- 8Attacking QA Platforms: Selenium Grid1 people · 1 points · first shared 2019 · discussion on HN
- 9Arecibo tool: endpoint for DNS and HTTP exfiltration1 people · 1 points · first shared 2018 · discussion on HN
- 10Fuzzing Tales 0x01: Yadifa DNS1 people · 1 points · first shared 2017 · discussion on HN
- 11Open and Collaborative Bluetooth Security Assessment Methodology (BSAM)1 people · 1 points · first shared 2023 · discussion on HN
- 12Cve 2023 48631 people · first shared 2023
What HN people wrote when they linked it
mrtesthah · 2025-03-16
I'm sure some of these newly discovered undocumented commands could help.
https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/
raphman · 2025-03-11
Context: https://www.tarlogic.com/news/hidden-feature-esp32-chip-infect-ot-devi…
Both HN discussion [1] and blogs [2] mentioned that it was a nothingburger.
tl;dr: there are undocumented debugging interfaces on the original ESP32 chip that can only be accessed by code running on the microcontroller or via another computer connected via the physical UART interface. No remote exploit possible. Espressif will now provide a patch to disable these debugging interfaces and document all yet-undocumented interfaces.
[1] https://news.ycombinator.com/item?id=43301369
[2] https://darkmentor.com/blog/esp32_non-backdoor/
runjake · 2025-03-11
> I have to wonder if Espressif is considering legal action.
As the article says, they worked with Tarlogic to provide a correction. So, probably not.
https://www.tarlogic.com/news/hidden-feature-esp32-chip-infect-ot-devi…
iou · 2025-03-09
Timely post with the vulnerability research this week? https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/
ValdikSS · 2025-03-09
It's the researchers itself call it a backdoor. Here's the announce on their website, in English
https://www.tarlogic.com/news/backdoor-esp32-chip-infect-ot-devices/
vGPU · 2023-10-02
https://www.tarlogic.com/blog/france-and-economic-intelligence/#French…
It appears to be more so that they just really suck.
EMM_386 · 2023-09-23
True, but either way the exploit needs to be addressed.
While I agree the attack vector is pretty awful, I was just curious exactly what the exploit was. The article doesn't even mention it.
It links to Apple, which is likely that 0-day 0-click that Pegasus uses (BLASTPASS). They report that as a flaw in PassKit though, which would not affect Android or Windows.
That's why I was thinking the WebP overflow?
That is actually worse, and makes the discussion here even more off-topic, because that has nothing to do with JavaScript. I has to do with decoding WebP images.
https://www.tarlogic.com/blog/cve-2023-4863/