7 ms·

They only hijacked the radio chip, they didn't escalate to the main processor. One way of attacking would be to intercept someone's internet traffic, and redir

They only hijacked the radio chip, they didn't escalate to the main processor. One way of attacking would be to intercept someone's internet traffic, and redirect them to a different site (ie, instead of going to Google, you go to get-hacked which looks just like Google).

pmontra 9y ago
They intercept and modify packets to redirect to a web site they control. It exploits the main processor through the browser.
- armitron 9y ago
  Assuming one has additional browser vulnerabilities, sandbox escapes and privilege escalation bugs. "Broadpwn" doesn't exploit main processor __anything__ by itself.
  - kybernetikos 9y ago
    Does the broadcom processor normally have access to main memory? If so, I would have to consider that a complete attack absent any mitigation technology.
    - londons_explore 9y ago
      No. It's a pci express device (or SDIO/usb for older chips). All modern platforms have IOMMU's for those, and every decent OS will enable it.
yifanlu 9y ago
> Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS. This implies they have code execution on the application processor just from broadpwn (and not additional safari/ios exploits). Hijacking internet traffic is indeed serious but tech blog sites are already picking up on this and blowing it up. Example: https://9to5mac.com/2017/07/20/broadpwn-wifi-vulnerability-iphone-ipad/ https://9to5mac.com/2017/07/20/broadpwn-wifi-vulnerability-i... > PSA: Update to iOS 10.3.3 to fix serious wifi vulnerability allowing attacker complete control
- azernik 9y ago
  Probably because a device on the system itself has tremendous privileges; aside from interacting with non-hardened kernel code (drivers generally trust the device but to be malicious), they generally have DMA access, in PCI can impersonate the CPU when speaking to other devices, and can generally cause all kinds of havoc.

pmontra 9y ago

They intercept and modify packets to redirect to a web site they control. It exploits the main processor through the browser.

armitron 9y ago
Assuming one has additional browser vulnerabilities, sandbox escapes and privilege escalation bugs. "Broadpwn" doesn't exploit main processor __anything__ by itself.
- kybernetikos 9y ago
  Does the broadcom processor normally have access to main memory? If so, I would have to consider that a complete attack absent any mitigation technology.
  - londons_explore 9y ago
    No. It's a pci express device (or SDIO/usb for older chips). All modern platforms have IOMMU's for those, and every decent OS will enable it.

yifanlu 9y ago

> Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS. This implies they have code execution on the application processor just from broadpwn (and not additional safari/ios exploits). Hijacking internet traffic is indeed serious but tech blog sites are already picking up on this and blowing it up. Example: https://9to5mac.com/2017/07/20/broadpwn-wifi-vulnerability-iphone-ipad/ https://9to5mac.com/2017/07/20/broadpwn-wifi-vulnerability-i... > PSA: Update to iOS 10.3.3 to fix serious wifi vulnerability allowing attacker complete control

azernik 9y ago
Probably because a device on the system itself has tremendous privileges; aside from interacting with non-hardened kernel code (drivers generally trust the device but to be malicious), they generally have DMA access, in PCI can impersonate the CPU when speaking to other devices, and can generally cause all kinds of havoc.