7 ms·

Apple: Heap Overflow in AppleBCMWLANCore Driver

137 points by 0x0 9y ago

mangix 9y ago
Wonder what this means in the grand scheme of things. Will Apple dump Broadcom and go with Qualcomm or attempt to fix Broadcom's broken driver. I say broken as I've yet to see good code come from Broadcom.
- revelation 9y ago
  This is a bug that was already fixed. It means nothing in the grand scheme. In the current grand scheme, Apple and Qualcomm are also currently suing each other and I'm pretty sure part of that is Apple withholding billions in payments.
  - floatingatoll 9y ago
    This is a Hacker News post about an interesting security vulnerability. It is, by both moderator and owner intentions, specifically meaningful in the 'grand scheme' of Hacker News, a site set up to permit people to discuss links. Yes, at a different level of business, Apple has an open lawsuit against Qualcomm, but that's not the scope that we're here to discuss. Mentioning it is fine, linking to a recent HN post about it would be stellar!, but "It means nothing in the grand scheme" is dismissive and wrong. Your concerns are clearly expressed, but insulting others for choosing to discuss a topic not relevant to your concerns is no excuse to shut them down verbally. That approach is not welcome here. EDIT: I'm not a mod or anything.
    - revelation 9y ago
      You are not a mod, you are a fool responding to a comment without ever reading the comment mine was in response to. What the fuck.
      - dang 9y ago
        Whoa. Attacking another user will get you banned here regardless of how bad some other comment was. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't ever post like this again.
- senatorobama 9y ago
  This isn't even in Broadcom code.
  - 0x0 9y ago
    Maybe not this time, but they have a history of fatal firmware bugs that could compromise the host system - such as http://boosterok.com/blog/broadpwn2/ http://boosterok.com/blog/broadpwn2/
    - microcolonel 9y ago
      For what it's worth, Broadcom's market share in attractive heavy-firmware wifi adapters is pretty high. They could just be an exploit magnet.
      - ge0rg 9y ago
        Does that mean that all embedded WiFi (and probably also baseband) controllers are deeply rotten, and we only blame Broadcom so far because of their popularity with device manufacturers?
        bsder 9y ago
        Pretty much. In general, you can assume that if you can't audit it, it's absolute crap. This is true for hardware and software.
    - senatorobama 9y ago
      These companies with widely available low level firmware should really switch to Rust.
      - ComputerGuru 9y ago
        I love rust and have rewritten a dozen cross-platform utilities in it, but rust is nowhere near usable for general purpose embedded development.
- ksec 9y ago
  Go with Qualcomm? Last time I check Atheros aren't any better software wise and much worse in hardware. I am not sure if there are any real alternative to Broadcom WiFi and Ethernet, apart from Apple making one themselves. ( The W1 and W2 may be part of this )
0x0 9y ago
Interestingly this was not part of the original iOS11 security announcement: http://web.archive.org/web/20170919182359/https://support.apple.com/en-us/HT208112 http://web.archive.org/web/20170919182359/https://support.ap... and (a mail to apple-security which is no longer archived at https://lists.apple.com/archives/security-announce/2017/Sep/threads.html#00000 https://lists.apple.com/archives/security-announce/2017/Sep/... ) But instead published after the fact as an additional update: https://lists.apple.com/archives/security-announce/2017/Sep/msg00002.html https://lists.apple.com/archives/security-announce/2017/Sep/... and https://support.apple.com/en-us/HT208112 https://support.apple.com/en-us/HT208112 Why delay the announcement? And why remove the original "APPLE-SA-2017-09-19-1 iOS 11" with "Date: Tue, 19 Sep 2017 -0700" from the apple-security email archive? Also, are Macbooks vulnerable to the same bug until next monday when macOS 10.13 drops? Also, there are about 6 other similar issues recently posted to Google Project Zero: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=owner:laginimaineb@google.com&sort=-id https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
walterbell 9y ago
Is this going to be fixed in iOS 10? Some users have apps which will not work with iOS 11, so cannot immediately upgrade.
- 0x0 9y ago
  Highly unlikely, I don't think Apple has ever released multiple branches of updates for any device. The closest is perhaps iOS 6.1.6, a fix for the fatal "gotofail" SSL vulnerability, which was pushed out to devices stuck on iOS 6.x, but if your device was eligible for iOS7 then iOS7(.0.6) was what you would get. That's also the only time I can remember security updates being pushed after a device model being end-of-life'd.
  - walterbell 9y ago
    Have they previously had an app transition like 32-bit / 64-bit, where some users cannot upgrade?
    - 0x0 9y ago
      Nope, so this is going to be interesting to watch. Personally I was hoping that they would offer an optional download of 32bit support libraries to let iOS11 users run important existing legacy apps and access their documents, but they seem to push hard on making developers get in line and update their apps. Which is unhelpful for the cases where the developers no longer have any interest in their apps or even exist (bankrupt, disbanded, in some cases deceased)
      - Razengan 9y ago
        If the developer is bankrupt, disbanded or deceased then the app generally can not remain published for longer than a year at most anyway. If the developer does not have any interest in updating their own app, do I as a user care about their apps?
        kranner 9y ago
sigjuice 9y ago
Is every buffer overflow important enough to need detailed discussion and commentary?
- 0x0 9y ago
  I think these latest sets of wifi flaws are interesting if it turns out they are exploitable by merely being in radio range of an attacker even without joining a malicious network or requiring user interaction. That could quickly become a fast and wormable attack. You could probably flood across an entire city jumping from chip to chip in no time. Especially now that iOS 11's wifi-off button in the control center no longer actually disables the radio, but merely disassociates from the current access point.
  - ronnier 9y ago
    > Especially now that iOS 11's wifi-off button in the control center no longer actually disables the radio I still can’t belive this decision. I keep my Bluetooth and Wi-Fi off as much as possible and it’s now difficult to to as a result of this change is ios11. Really bothers me.
    - sigjuice 9y ago
      Apple's explanation of why they did this. https://support.apple.com/en-us/HT208086 https://support.apple.com/en-us/HT208086
      - macintux 9y ago
        Thanks, their description is interesting. It’s not quite as bad as I thought.
    - Razengan 9y ago
      Just go into Settings and disable it as usual.
      - 9y ago
htmlcolor 9y ago
Oh, great, your article gives me useful information and a fresh perspective on the subject. https://wingsio202.wordpress.com https://wingsio202.wordpress.com

137 points by 0x0 9y ago

Wonder what this means in the grand scheme of things. Will Apple dump Broadcom and go with Qualcomm or attempt to fix Broadcom's broken driver. I say broken as I've yet to see good code come from Broadcom.

revelation 9y ago
This is a bug that was already fixed. It means nothing in the grand scheme. In the current grand scheme, Apple and Qualcomm are also currently suing each other and I'm pretty sure part of that is Apple withholding billions in payments.
- floatingatoll 9y ago
  This is a Hacker News post about an interesting security vulnerability. It is, by both moderator and owner intentions, specifically meaningful in the 'grand scheme' of Hacker News, a site set up to permit people to discuss links. Yes, at a different level of business, Apple has an open lawsuit against Qualcomm, but that's not the scope that we're here to discuss. Mentioning it is fine, linking to a recent HN post about it would be stellar!, but "It means nothing in the grand scheme" is dismissive and wrong. Your concerns are clearly expressed, but insulting others for choosing to discuss a topic not relevant to your concerns is no excuse to shut them down verbally. That approach is not welcome here. EDIT: I'm not a mod or anything.
  - revelation 9y ago
    You are not a mod, you are a fool responding to a comment without ever reading the comment mine was in response to. What the fuck.
    - dang 9y ago
      Whoa. Attacking another user will get you banned here regardless of how bad some other comment was. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't ever post like this again.
senatorobama 9y ago
This isn't even in Broadcom code.
- 0x0 9y ago
  Maybe not this time, but they have a history of fatal firmware bugs that could compromise the host system - such as http://boosterok.com/blog/broadpwn2/ http://boosterok.com/blog/broadpwn2/
  - microcolonel 9y ago
    For what it's worth, Broadcom's market share in attractive heavy-firmware wifi adapters is pretty high. They could just be an exploit magnet.
    - ge0rg 9y ago
      Does that mean that all embedded WiFi (and probably also baseband) controllers are deeply rotten, and we only blame Broadcom so far because of their popularity with device manufacturers?
      - bsder 9y ago
        Pretty much. In general, you can assume that if you can't audit it, it's absolute crap. This is true for hardware and software.
  - senatorobama 9y ago
    These companies with widely available low level firmware should really switch to Rust.
    - ComputerGuru 9y ago
      I love rust and have rewritten a dozen cross-platform utilities in it, but rust is nowhere near usable for general purpose embedded development.
ksec 9y ago
Go with Qualcomm? Last time I check Atheros aren't any better software wise and much worse in hardware. I am not sure if there are any real alternative to Broadcom WiFi and Ethernet, apart from Apple making one themselves. ( The W1 and W2 may be part of this )

0x0 9y ago

Interestingly this was not part of the original iOS11 security announcement: http://web.archive.org/web/20170919182359/https://support.apple.com/en-us/HT208112 http://web.archive.org/web/20170919182359/https://support.ap... and (a mail to apple-security which is no longer archived at https://lists.apple.com/archives/security-announce/2017/Sep/threads.html#00000 https://lists.apple.com/archives/security-announce/2017/Sep/... ) But instead published after the fact as an additional update: https://lists.apple.com/archives/security-announce/2017/Sep/msg00002.html https://lists.apple.com/archives/security-announce/2017/Sep/... and https://support.apple.com/en-us/HT208112 https://support.apple.com/en-us/HT208112 Why delay the announcement? And why remove the original "APPLE-SA-2017-09-19-1 iOS 11" with "Date: Tue, 19 Sep 2017 -0700" from the apple-security email archive? Also, are Macbooks vulnerable to the same bug until next monday when macOS 10.13 drops? Also, there are about 6 other similar issues recently posted to Google Project Zero: https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=owner:laginimaineb@google.com&sort=-id https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

walterbell 9y ago

Is this going to be fixed in iOS 10? Some users have apps which will not work with iOS 11, so cannot immediately upgrade.

0x0 9y ago
Highly unlikely, I don't think Apple has ever released multiple branches of updates for any device. The closest is perhaps iOS 6.1.6, a fix for the fatal "gotofail" SSL vulnerability, which was pushed out to devices stuck on iOS 6.x, but if your device was eligible for iOS7 then iOS7(.0.6) was what you would get. That's also the only time I can remember security updates being pushed after a device model being end-of-life'd.
- walterbell 9y ago
  Have they previously had an app transition like 32-bit / 64-bit, where some users cannot upgrade?
  - 0x0 9y ago
    Nope, so this is going to be interesting to watch. Personally I was hoping that they would offer an optional download of 32bit support libraries to let iOS11 users run important existing legacy apps and access their documents, but they seem to push hard on making developers get in line and update their apps. Which is unhelpful for the cases where the developers no longer have any interest in their apps or even exist (bankrupt, disbanded, in some cases deceased)
    - Razengan 9y ago
      If the developer is bankrupt, disbanded or deceased then the app generally can not remain published for longer than a year at most anyway. If the developer does not have any interest in updating their own app, do I as a user care about their apps?
      - kranner 9y ago

sigjuice 9y ago

Is every buffer overflow important enough to need detailed discussion and commentary?

0x0 9y ago
I think these latest sets of wifi flaws are interesting if it turns out they are exploitable by merely being in radio range of an attacker even without joining a malicious network or requiring user interaction. That could quickly become a fast and wormable attack. You could probably flood across an entire city jumping from chip to chip in no time. Especially now that iOS 11's wifi-off button in the control center no longer actually disables the radio, but merely disassociates from the current access point.
- ronnier 9y ago
  > Especially now that iOS 11's wifi-off button in the control center no longer actually disables the radio I still can’t belive this decision. I keep my Bluetooth and Wi-Fi off as much as possible and it’s now difficult to to as a result of this change is ios11. Really bothers me.
  - sigjuice 9y ago
    Apple's explanation of why they did this. https://support.apple.com/en-us/HT208086 https://support.apple.com/en-us/HT208086
    - macintux 9y ago
      Thanks, their description is interesting. It’s not quite as bad as I thought.
  - Razengan 9y ago
    Just go into Settings and disable it as usual.
    - 9y ago

htmlcolor 9y ago

Oh, great, your article gives me useful information and a fresh perspective on the subject. https://wingsio202.wordpress.com https://wingsio202.wordpress.com