6 ms·

Broadpwn Bug Affects Millions of Android and iOS Devices

69 points by ivank 9y ago

floatboth 9y ago
What about laptops with Broadcom Wi-Fi?
coldcode 9y ago
You know it affects Android but you only suspect it might affect iOS. That headline is misleading. "The researcher specifically points the finger at the Broadcom BCM43xx family of Wi-Fi chips included in "an extraordinarily wide range of mobile devices" from vendors such as Google (Nexus), Samsung, HTC, and LG." is missing one rather obvious vendor.
- bostand 9y ago
  To be fair, apple does its best to keep users in the dark in these matters. Every os release is full of security fixes they don't tell to about. Given apples history with wifi exploits there is a reasonable chance they are vulnerable.
robin_reala 9y ago
“There is no information on the status of this bug for iOS devices.” That slightly contradicts the headline.
- swsieber 9y ago
  But indeed, only slightly. The title comes from a quote by the security researcher who discovered the bug. I'm guessing the lack of information is about whether or not anything has been done to patch the hole - my guess is that this bug, unless specifically protected against, affects the OS using the chip.
- Analemma_ 9y ago
  iOS does a lot to treat the networking stack and its third-party firmware code as untrusted, and limit its exposure as much as possible. So it sounds like the exploit can get to the Broadcom chip on iPhones but can’t pivot to the OS from there. Hooray for defense in depth!
  - izacus 9y ago
    Eeem... could you provide some sources on that or is it just speculation on your part?
jmole 9y ago
Funny that Broadcom's Wifi business was just sold to Cypress last year.
Black-Plaid 9y ago
> Artenstein has later confirmed on Twitter that connecting to a malicious network is not necessary. > Users that didn't receive this month's Android security patch should only connect to trusted Wi-Fi networks and disable any "Wi-Fi auto-connect" feature, if using one. What is the point of the second statement?
- swsieber 9y ago
  Perhaps the auto-connect feature is what makes "connecting to a malicious network [not] necessary." It's easy to dismiss that second clause, but my guess is that it does some sort of network ping that opens itself up to the attack.
  - jwfxpr 9y ago
    From what I can gather from a quick look at the 802.11e QoS spec* this is pretty much spot on. Many wireless clients (e.g. many phones) ping in order to discover networks faster than the access point's broadcast interval and to connect to 'hidden' APs that might not broadcast. In response, a malformed WME packet could be sent that the wireless chipset would listen to and parse. *I am definitely not deeply familiar with WME.
pmontra 9y ago
> Users that didn't receive this month's Android security patch should only connect to trusted Wi-Fi networks Turning off Wi-Fi before leaving home and office helps. Apparently few people do that. A customer in the tracking industry (beacons estimating people in stores) told me that about 80% leave Wi-Fi always on. I hope I'll get that patch soon. The last update for my Sony phone was the security update of May. Nothing on June. I guess that most Androids didn't and won't get anything.
- kosinus 9y ago
  You are actively encouraged to leave wifi on, on ios at least, to improve location accuracy.
  - programbreeding 9y ago
    Same on Android. In fact Android has a Location-feature called "Scanning" that allows apps and services to detect wifi networks at any time, even if you have your wifi disabled. Meaning you can turn wifi off but it will randomly turn it back on to help increase location accuracy. This feature is on by default. https://www.reddit.com/r/Android/comments/3nrfa0/psa_wifi_scanning_reenabled_moved_locations_in_60/ https://www.reddit.com/r/Android/comments/3nrfa0/psa_wifi_sc...
- gruez 9y ago
  >told me that about 80% leave Wi-Fi always on which means 20% don't, which is suspiciously high considering how much of a hassle it is to turn wifi on/off. then again, they could have unlimited data on their phones.
  - bostand 9y ago
    Most powerusers run tasker or similar apps to automate these sort of stuff on android, so no hassle at all.
  - dingo_bat 9y ago
    > how much of a hassle it is to turn wifi on/off It's not a hassle at all. Pull down the notification shade, touch the wifi icon.
Kikawala 9y ago
More details as well as how to trigger the bug and what devices have been tested against it: http://boosterok.com/blog/broadpwn/ http://boosterok.com/blog/broadpwn/ We will know a lot more after @nitayart presents at BlackHat.
vvanders 9y ago
> The attacker doesn't need any user interaction to exploit the feature. A victim only needs to walk into the attacker's Wi-Fi network range. > In its security bulletin, Google rated Broadpwn as a "medium" severity issue, meaning the company doesn't view it as a dangerous vulnerability, such as Stagefright. Wait, really?
- wglb 9y ago
  Just guessing here but if it is true that you need to be connected to the rogue network for this flaw to be exposed, that could knock the severity down a notch. Like the difference between a pre-auth attack and an attack requiring authorized access.
wyldfire 9y ago
> BCM43xx family of Wi-Fi chips included in "an extraordinarily wide range of mobile devices" from vendors such as Google (Nexus), Samsung, HTC, and LG. It would be great if there were a published list of exactly which devices are vulnerable, or a way to check your device for whether this part was present. Is there anything like 'adb shell lspci' I could run to find out whether my devices have the broadcom parts? I know my Nexus 5x has a QCOM SoC, so I assume it lacks broadcom WiFi. But the rest of the family's devices -- what of those?
- ktta 9y ago
  On any device that isn't obscure, iFixit does a teardown detailing most of the parts on the board.
  - beagle3 9y ago
    A lot of vendors have multiple designs hiding under the same model, either through time (e.g., PS3 and Xbox 360 each had something like 5 revisions with different chipsets, not all were accompanied by change in box design), or just sharding - iphone 6 had two different models at the same time (one broadcom and one qualcomm IIRC) because they couldn't or wouldn't source the quantities they needed from just one source. iFixit is nice, but it is not an answer to the request made by GP (an answer to which would be useful).
    - ktta 9y ago
      There are always corner cases. Most phones definitely have the same chipsets, with the exact same parts. If you are looking for details directly from the device there are various commands to get info like dmesg, getprop. There are other ways (recommended if you have time and patience), like going into /sys/devices, but I really believe it is very common to have same parts for a single mobile device (I think Apple did it because of production problems)
    - hrrsn 9y ago
      Samsung are pretty notorious for this. Most of their phones come in many different models for different markets, from a quick google, both the S7 and S7 Edge have 14 different variants each. Some have different CPUs, many have differing internal parts, etc. It's a minefield. [1] http://techbeasts.com/list-of-samsung-galaxy-s7-s7-edge-model-numbers/ http://techbeasts.com/list-of-samsung-galaxy-s7-s7-edge-mode...
swiley 9y ago
I wonder if they're patching the firmware or just the Linux driver for the chip.
kalmi10 9y ago
Apple patched it in iOS 10.3.1 according to this report: http://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU-SA2017-008.pdf http://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU...
- osivertsson 9y ago
  From what I can tell that is unfortunately not correct. Broadpwn is another serious Broadcom WiFi security bug, different from the bugs patched when Google Project Zero revealed their research in April.

69 points by ivank 9y ago

What about laptops with Broadcom Wi-Fi?

You know it affects Android but you only suspect it might affect iOS. That headline is misleading. "The researcher specifically points the finger at the Broadcom BCM43xx family of Wi-Fi chips included in "an extraordinarily wide range of mobile devices" from vendors such as Google (Nexus), Samsung, HTC, and LG." is missing one rather obvious vendor.

bostand 9y ago
To be fair, apple does its best to keep users in the dark in these matters. Every os release is full of security fixes they don't tell to about. Given apples history with wifi exploits there is a reasonable chance they are vulnerable.

robin_reala 9y ago

“There is no information on the status of this bug for iOS devices.” That slightly contradicts the headline.

swsieber 9y ago
But indeed, only slightly. The title comes from a quote by the security researcher who discovered the bug. I'm guessing the lack of information is about whether or not anything has been done to patch the hole - my guess is that this bug, unless specifically protected against, affects the OS using the chip.
Analemma_ 9y ago
iOS does a lot to treat the networking stack and its third-party firmware code as untrusted, and limit its exposure as much as possible. So it sounds like the exploit can get to the Broadcom chip on iPhones but can’t pivot to the OS from there. Hooray for defense in depth!
- izacus 9y ago
  Eeem... could you provide some sources on that or is it just speculation on your part?

jmole 9y ago

Funny that Broadcom's Wifi business was just sold to Cypress last year.

Black-Plaid 9y ago

> Artenstein has later confirmed on Twitter that connecting to a malicious network is not necessary. > Users that didn't receive this month's Android security patch should only connect to trusted Wi-Fi networks and disable any "Wi-Fi auto-connect" feature, if using one. What is the point of the second statement?

swsieber 9y ago
Perhaps the auto-connect feature is what makes "connecting to a malicious network [not] necessary." It's easy to dismiss that second clause, but my guess is that it does some sort of network ping that opens itself up to the attack.
- jwfxpr 9y ago
  From what I can gather from a quick look at the 802.11e QoS spec* this is pretty much spot on. Many wireless clients (e.g. many phones) ping in order to discover networks faster than the access point's broadcast interval and to connect to 'hidden' APs that might not broadcast. In response, a malformed WME packet could be sent that the wireless chipset would listen to and parse. *I am definitely not deeply familiar with WME.

pmontra 9y ago

> Users that didn't receive this month's Android security patch should only connect to trusted Wi-Fi networks Turning off Wi-Fi before leaving home and office helps. Apparently few people do that. A customer in the tracking industry (beacons estimating people in stores) told me that about 80% leave Wi-Fi always on. I hope I'll get that patch soon. The last update for my Sony phone was the security update of May. Nothing on June. I guess that most Androids didn't and won't get anything.

kosinus 9y ago
You are actively encouraged to leave wifi on, on ios at least, to improve location accuracy.
- programbreeding 9y ago
  Same on Android. In fact Android has a Location-feature called "Scanning" that allows apps and services to detect wifi networks at any time, even if you have your wifi disabled. Meaning you can turn wifi off but it will randomly turn it back on to help increase location accuracy. This feature is on by default. https://www.reddit.com/r/Android/comments/3nrfa0/psa_wifi_scanning_reenabled_moved_locations_in_60/ https://www.reddit.com/r/Android/comments/3nrfa0/psa_wifi_sc...
gruez 9y ago
>told me that about 80% leave Wi-Fi always on which means 20% don't, which is suspiciously high considering how much of a hassle it is to turn wifi on/off. then again, they could have unlimited data on their phones.
- bostand 9y ago
  Most powerusers run tasker or similar apps to automate these sort of stuff on android, so no hassle at all.
- dingo_bat 9y ago
  > how much of a hassle it is to turn wifi on/off It's not a hassle at all. Pull down the notification shade, touch the wifi icon.

Kikawala 9y ago

More details as well as how to trigger the bug and what devices have been tested against it: http://boosterok.com/blog/broadpwn/ http://boosterok.com/blog/broadpwn/ We will know a lot more after @nitayart presents at BlackHat.

vvanders 9y ago

> The attacker doesn't need any user interaction to exploit the feature. A victim only needs to walk into the attacker's Wi-Fi network range. > In its security bulletin, Google rated Broadpwn as a "medium" severity issue, meaning the company doesn't view it as a dangerous vulnerability, such as Stagefright. Wait, really?

wglb 9y ago
Just guessing here but if it is true that you need to be connected to the rogue network for this flaw to be exposed, that could knock the severity down a notch. Like the difference between a pre-auth attack and an attack requiring authorized access.

wyldfire 9y ago

> BCM43xx family of Wi-Fi chips included in "an extraordinarily wide range of mobile devices" from vendors such as Google (Nexus), Samsung, HTC, and LG. It would be great if there were a published list of exactly which devices are vulnerable, or a way to check your device for whether this part was present. Is there anything like 'adb shell lspci' I could run to find out whether my devices have the broadcom parts? I know my Nexus 5x has a QCOM SoC, so I assume it lacks broadcom WiFi. But the rest of the family's devices -- what of those?

ktta 9y ago
On any device that isn't obscure, iFixit does a teardown detailing most of the parts on the board.
- beagle3 9y ago
  A lot of vendors have multiple designs hiding under the same model, either through time (e.g., PS3 and Xbox 360 each had something like 5 revisions with different chipsets, not all were accompanied by change in box design), or just sharding - iphone 6 had two different models at the same time (one broadcom and one qualcomm IIRC) because they couldn't or wouldn't source the quantities they needed from just one source. iFixit is nice, but it is not an answer to the request made by GP (an answer to which would be useful).
  - ktta 9y ago
    There are always corner cases. Most phones definitely have the same chipsets, with the exact same parts. If you are looking for details directly from the device there are various commands to get info like dmesg, getprop. There are other ways (recommended if you have time and patience), like going into /sys/devices, but I really believe it is very common to have same parts for a single mobile device (I think Apple did it because of production problems)
  - hrrsn 9y ago
    Samsung are pretty notorious for this. Most of their phones come in many different models for different markets, from a quick google, both the S7 and S7 Edge have 14 different variants each. Some have different CPUs, many have differing internal parts, etc. It's a minefield. [1] http://techbeasts.com/list-of-samsung-galaxy-s7-s7-edge-model-numbers/ http://techbeasts.com/list-of-samsung-galaxy-s7-s7-edge-mode...

swiley 9y ago

I wonder if they're patching the firmware or just the Linux driver for the chip.

kalmi10 9y ago

Apple patched it in iOS 10.3.1 according to this report: http://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU-SA2017-008.pdf http://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU...

osivertsson 9y ago
From what I can tell that is unfortunately not correct. Broadpwn is another serious Broadcom WiFi security bug, different from the bugs patched when Google Project Zero revealed their research in April.