News for hackers. Stuff that matters.

A comment on Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2). Parent comment

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) by fencepost on Tuesday April 11, 2017 @05:45PM (#14092783)
In the case of the Broadcom exploits being discussed in this series of articles, yes, the iPhone is almost certainly more secure than most (all?) Samsung devices with Android. In particular, the iOS 10.3.1 update released a week ago addresses "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" and credits the author of these articles and Google Project Zero. Because most iOS updates aren't carrier restricted (maybe on Verizon?) that update should be available to any device capable of running iOS 10.

If there are corresponding releases from Samsung I don't remember seeing any mention of them, and even so they'd presumably be waiting for carriers to approve them so there's a chance that some of them will be released by the time people are replacing their current phones anyway.

As for LineageOS, they may be able to address things in the driver, but in my somewhat outdated experience most ROMs don't touch the radio firmware. Radio firmware updates are a completely separate item.

[ Parent | on HN ]
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) by exhilaration on Tuesday April 11, 2017 @09:38PM (#14094091)
Supported Google Nexus and Pixel phones have the fix as well, I see "Remote code execution vulnerability in Broadcom Wi-Fi firmware" listed on the April update:

https://source.android.com/security/bulletin/2017-04-01

[ Parent | on HN ]
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) by fencepost on Wednesday April 12, 2017 @05:07PM (#14101760)
I'd regard Nexus and Pixel phones to be the equivalent of iPhones for something like this - they get updates directly from the "manufacturer"/Google, much as iPhones get updates from Apple.

Samsung-branded devices sold primarily through carriers on the other hand get updates when they finish passing through the system of Google->handset maker->carrier and often both the handset makers and carriers are big delay points.

[ Parent | on HN ]
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) by ReverseCold on Wednesday April 12, 2017 @10:39AM (#14098079)
(Almost?) no one has that update yet. Sample size 1.
[ Parent | on HN ]
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) by exhilaration on Wednesday April 12, 2017 @02:28PM (#14100405)
That's strange, do you have auto-updates disabled? My understanding is that it was immediately released. My Nexus 6P has it, I got it the same day it was released or a day after. Screenshot of my About Phone screen:

http://m.imgur.com/APSvk8Z

[ Parent | on HN ]