bana-io

Without a test-case, read POC, how do I verify if my server is affected?

Deserves more up-votes, this does.

I actually like the look of this, I especially like being able to set a serif font instead of whatever default is on https://news.ycombinator.com.

Maybe I am missing something but where is the entire source code?

You deserve a medal for that.

> What has not worked with wifi 7 is MLO, openWRT doesn't really support it very well yet and neither did the original firmware

I think this is spot on. On a Banana Pi Pro 4E, the vendor supplied image which carries custom patches supports MLD/MLO, yet when I try the latest upstream OpenWRT it doesn't work. I've not had too much time to investigate the reason(s) why.

It goes up in powers of two.

2, 4, 8 then 16.

Very nice.

Keychron, I own two of your keyboards, actually three. If you want to send me an evaluation version of this mouse or even a sample reach out to me at [email protected].

Keep up the good work.

Biggest change I would request is a password before macros are allowed to be used. I store some sensitive information in macros because I hate typing them out so a feature to unlock macros when the device is first powered up would be great. Example:

1. Device powers off.

2. Lock macros keys.

3. Device powers on.

4. Show led indicating that macros are locked.

5. Enter password to unlock macros.

6. Led indicator turns green or some other colour to indicate that lock was successful upon entering password.

7. Macros can then be used.

Any other ideas would be great.

I liked your post and I enjoyed reading it, who doesn't enjoy reading about Feynman?

But let's get scientific about this, you say:

> The test is absolute. There's no way to beat it; no way to fake

Where's the proof of that?

Click biat. Sorry.

I've created an issue in GitHub, please see https://github.com/NebuSec/CyberMeowfia/issues/46 (Samsung SM-S948B (S26 Ultra)).

It would be nice to get a `Dockerfile` to build the exploit/POC.

So I took the risk and ran it on a Samsung S26 Ultra - I will confirm the full details once I have `adb` installed and running.

The exploit/POC (call it what you want) ran or appeared to have executed because:

1. I saw output on the Firefox tab when I navigated to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...>.

2. I saw some output from the execution of the POC.

However, after I went to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...> the phone froze and refused to respond to any input. The only thing that worked was restarting, which I wonder how it works given the, I think, the kernel has hung. Does anyone know how the kernel is able to respond to events whilst the system has hung? The screen remains on with the partial output of the execution of the POC until the screen saver kicks in ...

Can you please provide a `Dockerfile` to build the POC/exploit?

What Android devices did you test on exactly?

I take it you did NOT unlock the bootloader?

> Two boot looped, I had to enter recovery and the other just powered off [0].

Absolutely crazy that it is possible to brick someone's phone via an exploit but ... hey.

After the power off what happened? Do things seem normal?

When it entered recovery mode where you able to get the phone in a clean state again? I take it that you did?

I'd really like to run this but I, ideally, do not want to run something random from the internet. It's a shame there is no `Dockerfile` to build this exploit/POC. All I want is LPE to `root` on a Samsung (Snapdragon) phone.

What I would have done is tested it with an Android phone. My Samsung S26 Ultra allows me to connect to an external display via a USB C hub. So the test setup would be:

1. Plug the phone into hub.

2. Check that you get display output, the mouse and keyboard are working whilst the screen is not turned off and the phone is not locked.

3. Lock the screen and wait for the screen to turn off, thereby mimicking suspend.

4. Try to make the phone resume by using the attached keyboard and/or mouse.

If all goes well, the monitor should turn on after unlocking the phone or using the keyboard / mouse.

# Other things to try

Again try and reproduce the issue with a Samsung tablet that supports display out via USB C.

Connect the keyboard via Bluetooth and try to make the laptop resume. I found that connecting a Keychron keyboard via bluetooth allowed me to resume a Macbook Pro. I was kinda surprised that this worked.

Does the same issue occur on Linux as well?

I guess you could attach a USB packet type of debugger to ensure that data is being sent to the laptop by attaching the debugger to the cable that connects to the host machine. If you see USB traffic when the monitor goes to sleep and you are pressing keys in the keyboard and the dock still has power that means the dock is working fine so you can rule that out.

Are you certain this is running OpenWRT? As in, can I get a OpenWRT build and flash it to the router and have it work?