4 ms·

This is the kind of thing I'd expect to see utilized by state-level actors who in many cases may be able to obtain internal technical information and tools from

This is the kind of thing I'd expect to see utilized by state-level actors who in many cases may be able to obtain internal technical information and tools from vendors. I wouldn't expect this to become an in-the-wild exploit, but for targeted use by agencies with the resources and motivations to identify specific models, obtain them and test against them this kind of thing should be relatively easy. As an example, what kind of Android device is best used for insomniac tweets? At one point I thought I saw mentioned that it was a Samsung device a generation or two old, so perhaps a Galaxy S5 suitable for tweeting from the tub? That's a known-vulnerable device, elderly by Android standards of "who gets updates" meaning that Samsung and the carriers don't put any priority on it. Sure you can look at things like LineageOS, but since part of the problem here is in the proprietary firmware blob of the chipset there may still be problems that aftermarket OS upgrades aren't going to touch. For that matter, is Trump's possible change to an iPhone within the last month[1] related to this, and has it stuck of does he still have a Samsung floating around as seems to be the case? [1] http://money.cnn.com/2017/03/29/technology/trump-iphone-android-twitter/index.html http://money.cnn.com/2017/03/29/technology/trump-iphone-andr... edit: more neutral

trendia 10y ago
Is the iPhone actually more secure than a Samsung running Android? And I don't think LineageOS is going to fix the problem since it (probably) uses the same Broadcom driver in the Linux kernel.
- fencepost 10y ago
  In the case of the Broadcom exploits being discussed in this series of articles, yes, the iPhone is almost certainly more secure than most (all?) Samsung devices with Android. In particular, the iOS 10.3.1 update released a week ago addresses "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" and credits the author of these articles and Google Project Zero. Because most iOS updates aren't carrier restricted (maybe on Verizon?) that update should be available to any device capable of running iOS 10. If there are corresponding releases from Samsung I don't remember seeing any mention of them, and even so they'd presumably be waiting for carriers to approve them so there's a chance that some of them will be released by the time people are replacing their current phones anyway. As for LineageOS, they may be able to address things in the driver, but in my somewhat outdated experience most ROMs don't touch the radio firmware. Radio firmware updates are a completely separate item.
  - exhilaration 10y ago
    Supported Google Nexus and Pixel phones have the fix as well, I see "Remote code execution vulnerability in Broadcom Wi-Fi firmware" listed on the April update: https://source.android.com/security/bulletin/2017-04-01 https://source.android.com/security/bulletin/2017-04-01
    - ReverseCold 10y ago
      (Almost?) no one has that update yet. Sample size 1.
      - exhilaration 10y ago
        That's strange, do you have auto-updates disabled? My understanding is that it was immediately released. My Nexus 6P has it, I got it the same day it was released or a day after. Screenshot of my About Phone screen: http://m.imgur.com/APSvk8Z http://m.imgur.com/APSvk8Z
    - fencepost 10y ago
      I'd regard Nexus and Pixel phones to be the equivalent of iPhones for something like this - they get updates directly from the "manufacturer"/Google, much as iPhones get updates from Apple. Samsung-branded devices sold primarily through carriers on the other hand get updates when they finish passing through the system of Google->handset maker->carrier and often both the handset makers and carriers are big delay points.
jacquesm 10y ago
I would totally expect this kind of thing to be already in the wild for the simple reason that people have been saying this sort of thing is possible for many years, it is just not the sort of thing that once the parties capable of doing it have found a practical exploit that they are then going to turn around and publish it to make the world a better place. On the contrary, it will be hoarded and used against suitable targets. An earlier hacker news thread around this theme: https://news.ycombinator.com/item?id=10905643 https://news.ycombinator.com/item?id=10905643
- fencepost 10y ago
  In the wild as in "being actively exploited" yes, that's quite possible, but it's not a practical exploit for large-scale hacks on devices. The required firmware changes are likely to be somewhat different for each version of the radio hardware and firmware and each carrier's OS variants. That means that you'd either need a very sophisticated set of exploit code (which means complicated and bulky when you may not have a lot of space to play with and may be working in hand-optimized assembler) or that you need to narrow your focus to only specified handsets. Even after that, you then have to have a WiFi access point pushing this, so even if you're in a high-traffic area such as a city downtown or an airport you're going to impact a relatively small percentage of devices. If you have control of a large botnet of compromised WiFi routers you might be able to push this from those, but the more you do that the more likely you are to be discovered, and you're still going to have the problem of selectivity. What this all translates to is that exploiting this on a wide scale would require a lot of resources and extremely skilled developers while also being at fairly high risk of detection. Using this for highly targeted attacks on the other hand would allow for less work generalizing the attack and could probably go undetected. Further, if someone not a state actor has "weaponized" this their best option for making money on it would likely be to sell the exploit to either a government or to one of the groups who specializes in targeted hacking.
  - jacquesm 10y ago
    It all depends on who you are. Politician or CEO of a multinational or a company related to defense? Political activist? Enemy of the state? The opposition? Hacker? It doesn't have to be 'large scale' to be effective and given how hidden an attack like this could be (and how easy it would be to erase the fact that it was even there) it may have been used on your device and you still wouldn't be aware of it or able to prove that it was.

trendia 10y ago

Is the iPhone actually more secure than a Samsung running Android? And I don't think LineageOS is going to fix the problem since it (probably) uses the same Broadcom driver in the Linux kernel.

fencepost 10y ago
In the case of the Broadcom exploits being discussed in this series of articles, yes, the iPhone is almost certainly more secure than most (all?) Samsung devices with Android. In particular, the iOS 10.3.1 update released a week ago addresses "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" and credits the author of these articles and Google Project Zero. Because most iOS updates aren't carrier restricted (maybe on Verizon?) that update should be available to any device capable of running iOS 10. If there are corresponding releases from Samsung I don't remember seeing any mention of them, and even so they'd presumably be waiting for carriers to approve them so there's a chance that some of them will be released by the time people are replacing their current phones anyway. As for LineageOS, they may be able to address things in the driver, but in my somewhat outdated experience most ROMs don't touch the radio firmware. Radio firmware updates are a completely separate item.
- exhilaration 10y ago
  Supported Google Nexus and Pixel phones have the fix as well, I see "Remote code execution vulnerability in Broadcom Wi-Fi firmware" listed on the April update: https://source.android.com/security/bulletin/2017-04-01 https://source.android.com/security/bulletin/2017-04-01
  - ReverseCold 10y ago
    (Almost?) no one has that update yet. Sample size 1.
    - exhilaration 10y ago
      That's strange, do you have auto-updates disabled? My understanding is that it was immediately released. My Nexus 6P has it, I got it the same day it was released or a day after. Screenshot of my About Phone screen: http://m.imgur.com/APSvk8Z http://m.imgur.com/APSvk8Z
  - fencepost 10y ago
    I'd regard Nexus and Pixel phones to be the equivalent of iPhones for something like this - they get updates directly from the "manufacturer"/Google, much as iPhones get updates from Apple. Samsung-branded devices sold primarily through carriers on the other hand get updates when they finish passing through the system of Google->handset maker->carrier and often both the handset makers and carriers are big delay points.

jacquesm 10y ago

I would totally expect this kind of thing to be already in the wild for the simple reason that people have been saying this sort of thing is possible for many years, it is just not the sort of thing that once the parties capable of doing it have found a practical exploit that they are then going to turn around and publish it to make the world a better place. On the contrary, it will be hoarded and used against suitable targets. An earlier hacker news thread around this theme: https://news.ycombinator.com/item?id=10905643 https://news.ycombinator.com/item?id=10905643

fencepost 10y ago
In the wild as in "being actively exploited" yes, that's quite possible, but it's not a practical exploit for large-scale hacks on devices. The required firmware changes are likely to be somewhat different for each version of the radio hardware and firmware and each carrier's OS variants. That means that you'd either need a very sophisticated set of exploit code (which means complicated and bulky when you may not have a lot of space to play with and may be working in hand-optimized assembler) or that you need to narrow your focus to only specified handsets. Even after that, you then have to have a WiFi access point pushing this, so even if you're in a high-traffic area such as a city downtown or an airport you're going to impact a relatively small percentage of devices. If you have control of a large botnet of compromised WiFi routers you might be able to push this from those, but the more you do that the more likely you are to be discovered, and you're still going to have the problem of selectivity. What this all translates to is that exploiting this on a wide scale would require a lot of resources and extremely skilled developers while also being at fairly high risk of detection. Using this for highly targeted attacks on the other hand would allow for less work generalizing the attack and could probably go undetected. Further, if someone not a state actor has "weaponized" this their best option for making money on it would likely be to sell the exploit to either a government or to one of the groups who specializes in targeted hacking.
- jacquesm 10y ago
  It all depends on who you are. Politician or CEO of a multinational or a company related to defense? Political activist? Enemy of the state? The opposition? Hacker? It doesn't have to be 'large scale' to be effective and given how hidden an attack like this could be (and how easy it would be to erase the fact that it was even there) it may have been used on your device and you still wouldn't be aware of it or able to prove that it was.