19 ms·
Over the Air: Exploiting Broadcom’s Wi-Fi Stack
- kyrra 10y agoFor reference, here is the bug[0] that affected Apple that was discussed yesterday[1]. One commenter on that HN topic noticed that there was 1 other public bug about Broadcom wifi chips, though it was not the specific one that affected Apple. This blog post points to 4 Project Zero bugs for different Broadcom issues. [0] https://bugs.chromium.org/p/project-zero/issues/detail?id=1059 https://bugs.chromium.org/p/project-zero/issues/detail?id=10... [1] https://news.ycombinator.com/item?id=14024971 https://news.ycombinator.com/item?id=14024971
- scarybeast 10y agoThis is one of the most serious and instructive pieces of technical security work we're likely to see this year. In case it hasn't sunk it: - This vulnerability affects tons of smart phones (iPhone, Nexus, Samsung S*). - The attack proceeds silently over WiFi -- you wouldn't see any indication you've been nailed. - Mitigations and protections on WiFi embedded chips are weak. - The second blog post will show how to fully commandeer the main phone processor by _hopping from the WiFi chip to the host_. Imagine the havoc you could wreak by walking around a large city downtown, spewing out exploits to anyone who comes into WiFi range :-)
- JumpCrisscross 10y agoDo you know which iPhone versions are affected? Is the problem patchable?
- wolf550e 10y agohttps://support.apple.com/en-us/HT207688 https://support.apple.com/en-us/HT207688
- metricodus 10y agoReleased yesterday. I hadn't gotten any update prompt yet. I'm guessing the (vast?) majority of iOS users haven't upgraded yet.
- JumpCrisscross 10y agoInteresting seeing the Project Zero post mentions Android, not Apple. This deference to Cupertino contrasts with Project Zero's willingness to directly call out Microsoft. (Granted, at the time of this Project Zero post Apple had already released a patch. Microsoft, from my recollection, has a habit of blowing through its 90 days.) [1] https://www.theregister.co.uk/2017/02/27/google_project_zero_reports_flaw_in_ie_edge/ https://www.theregister.co.uk/2017/02/27/google_project_zero...
- kccqzy 10y agoIt does mention that all iPhones since iPhone 4 are vulnerable. Historically, depending on the patch, Apple has also failed to produce a patch within the 90-day deadline.
- devy 10y agoiOS 10.3.1 and above fixed this.
- deleted 10y ago[deleted]
- IshKebab 10y agoI may be reading it wrong, but I think you have to be on the same network as the victim. Still, you're right this is very serious.
- jessaustin 10y agoJust set your SSID to "attwifi" or "xfinitywifi" or similar, and lots of devices will connect automatically.
- icambron 10y agoA worm using this exploit could presumably spread itself as the user hops between networks as part of their routine.
- 24gttghh 10y agoI would agree that TDLS requires a common network over which to broadcast the "Discovery Request" frame.
- kbuck 10y agoThis is the important bit: > However, much more interestingly, we see that the implementation for [vendor-specific] command #4 seems relevant to our current pursuit. First, it does not require the existence of a TDLS connection in order to be processed!
- userbinator 10y agoImagine the havoc you could wreak by walking around a large city downtown, spewing out exploits to anyone who comes into WiFi range :-) An idea that immediately comes to mind is to root everyone's phones, patch the firmware to fix the bugs, and then do nothing more than perhaps leave a short yet profound message: "Thanks to a bug, you now have full control of your device. Was that a bug? You decide. Enjoy responsibly." http://boingboing.net/2012/01/10/lockdown.html http://boingboing.net/2012/01/10/lockdown.html
- overlordalex 10y agoThat reminds me of the worm[1] that would patch the system, and then self-destruct. The problem being that it caused massive load on the servers distributing the patches, as well as restarting users computers without warning. [1]https://en.wikipedia.org/wiki/Welchia https://en.wikipedia.org/wiki/Welchia
- caio1982 10y agoThat is one of the most educative text I've ever read on network hacking/security, cannot wait for the next part(s)!
- chillydawg 10y agoProject Zero are seriously doing good work here. This attack can passively own a large portion of all modern smartphones if unpatched against these vulns.
- osivertsson 10y agoWhoa! This is really impressive stuff, and will cause head-ache in my dayjob where we develop a product using this WiFi SoC. Can this vulnerability cause content-owners and DRM vendors to no longer allow such devices to decode 4K content? I'm thinking of for example PlayReady certification that may be withdrawn/downgraded because of this issue, but I'm fuzzy on the details how this would work.
- jessaustin 10y agoHow do these certifications deal with e.g. rooted devices (rooted by the device owner, not an attacker)? One suspects that there's not much they can do? If that's the case, why would they worry about this vuln?
- kuschku 10y agoThose devices already can’t play DRM content. Or use Android Pay. Or use Snapchat. Many apps, and especially all with DRM content, require a fully signed boot, and if the user at any point even can see what any app is doing, or MitM anything, will refuse to work. Google has published a solution for this which uses TrustZone to create a hash of the system, transmit this to the Google servers, and Google then verifies the hash, and transmits a token to the servers of the app willing to play DRM content. Rooting, or even unlocking your bootloader, already makes your phone useless today by design. Which makes the work of projects like Replicant harder.
- flukus 10y agoHow many apps use DRM? If androids going to be that locked down then I may as well get an iphone.
- userbinator 10y agoI can't verify them, but a quick search reveals that people have found ways to use those apps on a rooted device.
- 10y ago
- glasshead969 10y agoiOS 10.3.1 patches this exploit. https://support.apple.com/en-us/HT207688 https://support.apple.com/en-us/HT207688
- jacquesm 10y agoThat's going to hurt a lot of folks. Especially those whose manufacturers are not doing their bit with respect to updates. It's absolutely incredible to me how sloppy manufacturers are when it comes to keeping phones updated, they seem to see phones that are older than two years as effectively end-of-life. Even Google is guilty of this, though to a slightly lesser extent. See: http://www.androidpolice.com/2016/06/21/google-support-site-now-lists-end-life-dates-nexus-devices/ http://www.androidpolice.com/2016/06/21/google-support-site-... So three years or 18 months past sale. Personally I think that a phone is only end-of-life when it stops to work and that manufacturers should either offer to buy them back if they don't want to support them any longer or should be forced to provide security updates.
- rbcgerard 10y agoOr at least commit to a period of support like a warranty so at least it's another metric to consider upfront when purchasing
- metricodus 10y agoThe EU loves creating standardized sticker layouts. In this case I would welcome it. "Security updates guaranteed for: nn months" or "Security updates guaranteed until: YYYY/MM" There should be a also scheme where companies who claim these things would have to deposit some calculated amount in some offical place. (Btw, since so there's so much cheap crap being imported from china, I guess the most consumer-protecting approach would be to make both the reseller and producer responsible for the penalties resulting from a lack of security updates.)
- Zenst 10y agoNot sure about the EU, but the UK has this covered under the Sales of Goods Act: https://en.wikipedia.org/wiki/Sale_of_Goods_Act_1979 https://en.wikipedia.org/wiki/Sale_of_Goods_Act_1979
- metricodus 10y ago
- 8_hours_ago 10y agoThis research is effectively a free audit of Broadcom's firmware by Google. At what point does Broadcom approach Google, have the appropriate NDAs signed, and give them access to the source code? If someone is providing a (very valuable) free service to you, wouldn't you want to make their lives easier? I assume there are some important reasons why this wouldn't occur, but at first glance, it seems to me that the pros outweigh the cons.
- chillydawg 10y agoI suspect every time something like this happens, Google gets a little more access into the stack of the various tech used in stuff it sells/runs from third parties. Broadcom of yesterday may never have handed the code over, Broadcom of today would probably send it over with a case of champagne and a stack of hardware to test with.
- gsnedders 10y agoAt the same time, it potentially makes it more likely they'll find more bugs, and all Project Zero bugs are publicly disclosed, which is bad from a marketing point-of-view for Broadcom.
- jacquesm 10y agoNo, it would be a positive: after sending project 0 our source code and fixing everything they've found in the first 6 months they failed to find anything for the last 6 months. Compare to our competitors who are still subject to such finds roughly once per 2 month period.
- flukus 10y agoI think you're assuming a somewhat redeemable codebase. For most I'd be guessing it's a choice between completely rewriting the drivers or a never ending game of wack-a-mole. Management will see both options as costing a lot and delivering zero value.
- mrb 10y agoHow ironic. Yesterday on HN someone said "Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago" [1] And today we have this very impressive counter-example of Google putting some engineers to work for months doing vuln research for making, in the end, EVERYONE safer: Apple users, Samsung users, and hundreds of other mobile device vendors who use this popular Broadcom Wi-Fi chipset in products shipped to 1B+ users. But no, somehow, tomorrow again it is going to be all Google's faults that Android-derived commercial works are insecure and poorly maintained by their respective vendors. [1] https://news.ycombinator.com/item?id=14023969 https://news.ycombinator.com/item?id=14023969
- berberous 10y agoGoogle has 57,000 employees. There is always going to be some good, some bad, in an organization that size. The Project Zero team is excellent and we should all be grateful for their work. But we should also continue to hold Google's feet to the fire on the state of Android security, since it is truly a mess, and they are probably the only player to have the power and ability to fix it.
- mrb 10y agoAndroid is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates. If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.
- wtallis 10y ago
- deleted 10y ago[deleted]
- toperc 10y agoI blame them for using C
- IshKebab 10y agoTo be fair on microcontrollers there aren't many other options. (Don't say Rust.)
- fulafel 10y agoThis is not bleeding edge stuff, some systems in the 70s with fraction of the RAM and CPU power had memory safety. Eg see here about running Ada on the same Cortex M4: http://www.ganssle.com/video/episode9-ada-on-a-microcontroller.html http://www.ganssle.com/video/episode9-ada-on-a-microcontroll...
- pjmlp 10y agoAda, Pascal, Basic, Oberon, Java. On the phone now, but can easily provide links to vendors selling compilers targeting microcontrollers, for all those languages.
- qb45 10y agoAre there really commercial BASIC and Oberon compilers targeting ARM microcontrollers? It seems the world is a much richer place then I have ever imagined :)
- pjmlp 10y agoYes there are. MikroElectronica sells Basic and Pascal compilers. https://www.mikroe.com/ https://www.mikroe.com/ Astrobe sells Oberon compilers http://www.astrobe.com/default.htm http://www.astrobe.com/default.htm
- IshKebab 10y agoJava please. There's absolutely no way that can run on the kind of microcontroller we're talking about. Did you read the part about having 300 bytes spare?!
- shock 10y ago> Broadcom have informed me that newer versions of the SoC utilise the MPU, along with several additional hardware security mechanisms. This is an interesting development and a step in the right direction. They are also considering implementing exploit mitigations in future firmware versions. ...considering implementing exploit mitigations in future firmware versions. I'm somewhat doubtful that they give much shit unless it hurts their bottom line. This sounds like lip service. What else are they gonna say? "We're not considering implementing exploit mitigations"?
- tptacek 10y agoModern exploit mitigations in MCUs and RTOS systems are definitely not the norm.
- hmottestad 10y agoMy wife has a Huawei P7. Seems like it has the Broadcom chip :( Huawei has provided exactly 1 update to the phone since it was released. And only for those living in New Zealand. Other than clearing out all the trusted wifis and just keeping the home wifi, is there anything at all that can be done?
- dleibovic 10y agoIs there a way to tell if my android phone received an update to protect against this exploit?
- Aissen 10y agoUnless you have a Nexus or Pixel, it probably hasn't.
- blumentopf 10y agoThere's a bug in Apple's EFI driver for BCM4331 cards present on a lot of older Macs which keeps the card enabled even after handing over control to the OS. A patch went into Linux 4.7 to reset the card in an early quirk, but I suspect other OSes can be taken over via WiFi on the affected machines: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=abb2bafd295f https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
- qb45 10y agoThis one is soft-MAC I think.
- thomastjeffery 10y agoThis is a prime example of why manufacturers (like Broadcom) should always have open source drivers. Also a prime example of why manufacturers should always allow the user to update device the software on his/her device. Broadcom's closed driver stack has gone from the Linux user's headache to a serious vulnerability in most phones. When will vendors get it through their respective thick skulls that there is no legitimate reason or benefit to keeping their drivers proprietary?