Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by userbinator on Tuesday April 04, 2017 @10:27PM
(#14039165)
Imagine the havoc you could wreak by walking around a large city downtown, spewing out exploits to anyone who comes into WiFi range :-)
An idea that immediately comes to mind is to root everyone's phones, patch the firmware to fix the bugs, and then do nothing more than perhaps leave a short yet profound message: "Thanks to a bug, you now have full control of your device. Was that a bug? You decide. Enjoy responsibly."
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by overlordalex on Wednesday April 05, 2017 @06:31AM
(#14041064)
That reminds me of the worm[1] that would patch the system, and then self-destruct. The problem being that it caused massive load on the servers distributing the patches, as well as restarting users computers without warning.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by IshKebab on Tuesday April 04, 2017 @03:24PM
(#14036283)
I may be reading it wrong, but I think you have to be on the same network as the victim. Still, you're right this is very serious.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by jessaustin on Tuesday April 04, 2017 @03:40PM
(#14036440)
Just set your SSID to "attwifi" or "xfinitywifi" or similar, and lots of devices will connect automatically.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by icambron on Tuesday April 04, 2017 @03:45PM
(#14036488)
A worm using this exploit could presumably spread itself as the user hops between networks as part of their routine.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by kbuck on Tuesday April 04, 2017 @10:57PM
(#14039305)
This is the important bit:
> However, much more interestingly, we see that the implementation for [vendor-specific] command #4 seems relevant to our current pursuit. First, it does not require the existence of a TDLS connection in order to be processed!
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by 24gttghh on Tuesday April 04, 2017 @03:47PM
(#14036504)
I would agree that TDLS requires a common network over which to broadcast the "Discovery Request" frame.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by JumpCrisscross on Tuesday April 04, 2017 @01:56PM
(#14035454)
Do you know which iPhone versions are affected? Is the problem patchable?
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by JumpCrisscross on Tuesday April 04, 2017 @02:38PM
(#14035896)
Interesting seeing the Project Zero post mentions Android, not Apple. This deference to Cupertino contrasts with Project Zero's willingness to directly call out Microsoft. (Granted, at the time of this Project Zero post Apple had already released a patch. Microsoft, from my recollection, has a habit of blowing through its 90 days.)
[1] https://www.theregister.co.uk/2017/02/27/google_project_zero...
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by kccqzy on Tuesday April 04, 2017 @06:52PM
(#14038008)
It does mention that all iPhones since iPhone 4 are vulnerable. Historically, depending on the patch, Apple has also failed to produce a patch within the 90-day deadline.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack
by metricodus on Tuesday April 04, 2017 @02:14PM
(#14035671)
Released yesterday. I hadn't gotten any update prompt yet. I'm guessing the (vast?) majority of iOS users haven't upgraded yet.
- This vulnerability affects tons of smart phones (iPhone, Nexus, Samsung S*). - The attack proceeds silently over WiFi -- you wouldn't see any indication you've been nailed. - Mitigations and protections on WiFi embedded chips are weak. - The second blog post will show how to fully commandeer the main phone processor by _hopping from the WiFi chip to the host_.
Imagine the havoc you could wreak by walking around a large city downtown, spewing out exploits to anyone who comes into WiFi range :-)