9 ms·

Operating Broadcom Wi-Fi Chips as Arbitrary Signal Transmitters, Like SDRs

176 points by bcaa7f3a8bbc 9y ago

FPGAhacker 9y ago
Halfway to making a handheld radar.
- dharma1 9y ago
  What's the missing half?
  - trelliscoded 9y ago
    Quadrature receiver.
drefanzor 9y ago
I'll stick with my RTL-SDR thanks :)
- taxidump 9y ago
  RTL-SDR is RX only.
  - duskwuff 9y ago
    It also has much lower bandwidth than a wifi chipset. (And doesn't even get close to the 5 GHz range.)
  - sliken 9y ago
    Try a limesdr then.
  - zaarn 9y ago
    Personally, having an RX only SDR is sufficient, there is so much interesting stuff to listen too.
bcaa7f3a8bbc 9y ago
There are some interesting applications... Matthias Schulz, Jakob Link, Francesco Gringoli, and Matthias Hollick. Shadow Wi-Fi: Teaching Smartphones to Transmit Raw Signals and to Extract Channel State Information to Implement Practical Covert Channels over Wi-Fi. Accepted to appear in Proceedings of the 16th ACM International Conference on Mobile Systems, Applications, and Services, MobiSys 2018, June 2018. Matthias Schulz. Teaching Your Wireless Card New Tricks: Smartphone Performance and Security Enhancements through Wi-Fi Firmware Modifications. Dr.-Ing. thesis, Technische Universität Darmstadt, Germany, February 2018. But the papers are nowhere to be found. Just went through peer review and still waiting for public publication?
- mirimir 9y ago
  Secure mixnet using Android devices would be very cool.
  - bcaa7f3a8bbc 9y ago
    Chaum's Store-and-Forward mixnet or Tor's Realtime Onion Routing? I think both can be built with Wi-Fi Direct on Android. But the end-point security may be less-than-ideal...
    - mirimir 9y ago
      I don't know. Maybe Riffle. Mostly it was the idea of using a custom spread-spectrum channel with strong encryption. Edit: + covert channels
- pgeorgi 9y ago
  > Matthias Schulz. Teaching Your Wireless Card New Tricks: Smartphone Performance and Security Enhancements through Wi-Fi Firmware Modifications. Dr.-Ing. thesis, Technische Universität Darmstadt, Germany, February 2018. might be coming soon. Feb 2018 is pretty recent, and publication is sometimes delayed due to procedural issues. However, it might just be "published" by having a number of copies in the university's (as well as the state's and German federal) libraries.
bigiain 9y ago
This opens up some exciting new ways to break radio spectrum laws! (I see the Raspberry Pi W is supported there... Hmmm...)
- tlrobinson 9y ago
  Or get a ham radio license and go wild (within the limits of that license)
  - escherplex 9y ago
    You have a point. 23cm band gives you a bandwidth of 60MHz to play with. The 13cm (2.3-2.45 GHz) playground also happens to be within the frequency range of your microwave oven (2.45GHz) so experimenting with high ERP in that area will probably have physiological consequences.
xt00 9y ago
Only in WiFi bands.. so not super flexible as you would expect from an actual SDR rig.. or maybe I’m missing that it can actually transmit in other bands ?
- bcaa7f3a8bbc 9y ago
  Yes, Wi-Fi bands only.
- trelliscoded 9y ago
  RF compliance is really complicated in mobile devices, so there's all kinds of filters to prevent out of band emissions from being generated. The analog parts like the amplifiers are also precisely tuned to only use certain bands.
- askvictor 9y ago
  Is this a limitation of the antenna, or the hardware itself?
  - makomk 9y ago
    Probably both. The antenna's designed for a specific band, and on top of it the actual frequency synthesis hardware is likely only designed to be capable of generating signals in certain bands, as are all the amplifiers etc.
- userbinator 9y ago
  This particular hardware may be limited to those frequencies but I believe the Mediatek combo chips that do WiFi+BT+GPS+GLONASS+Beidou+FM as well as GSM are capable of a much wider range. WiFi and BT are at 2.4GHz but GSM/UMTS/LTE reach up to 2.6GHz and down to 800-900MHz, and the various navigation systems use frequencies in the 1.x GHz range. From what I've read, only the FM hardware is different due to its vastly different frequency (76-108MHz, although the hardware could probably go beyond those ranges slightly) but everything else is based on the same SDR.
  - xt00 9y ago
zokier 9y ago
This is exactly the sort of thing why FCC wants to lock down wlan ap/router firmwares. So, while a cool hack indeed, it is also bit unfortunate that it also kinda justifies FCCs position
- jonashoechst 9y ago
  I think this only shows the insanity of FCCs statement, as the Broadcom firmware _is_ locked down and got hacked either way. If somebody wanted to transmit arbitrarily on this bands he or she could just use regular SDRs.
  - taneq 9y ago
    Or even just build a transmitter.
- awalton 9y ago
  Yeah that's not a strong argument at all. The 2.4GHz and 5GHz bands are known widely as "garbage bands" due to how terrible they are to work with (e.g. rain will heavily attenuate your signal, they're literally how microwaves work to cook your food, etc.). Moreover, there are plenty of radios on the market that transmit all kinds of noise on these channels that isn't WiFi (e.g. my neighbors had a baby monitor that I could tell when it was on by how shit my WiFi was at that moment, FPV drones somewhat frequently use this band with proprietary analog video transports, etc.) This is permitted because these channels are "unregulated" (or, more realistically, "regulated for unlicensed operation"). On top of that, the FCC's official statement on this very topic was that what they really care about is the amount of power being put into these channels, as some aftermarket router firmwares of varying repute would let you crank the output wattage above FCC regulations for these frequencies (<1W power to stay within unlicensed operation regulations for 2.4GHz), and apparently some in-market WiFi routers picked up those firmwares as a "supported" option (I think ASUS and Linksys were both named). Most of these routers have since patched themselves to stay regulation-safe. So, go nuts, just stay below 30 dBm/1W from the transmitter in 2.4Ghz channels or prepare for a visit from the FCC. (You'll have to do your own research for 5GHz).
Y_Y 9y ago
Nice to see that instead of a free license they've opted for a bullshit made-up one where they want you to cite their papers.
- matthewmacleod 9y ago
  Why is that “bullshit”?
  - michaelt 9y ago
    License proliferation leads to complicated license compatibility relationships [1]. Imagine someone wanted to, say, provide native support in GNUradio - as has been done for the RTL-SDR. It's impossible unless you relicense one or the other. Of course, the code's being given away for free; you could argue one shouldn't look a gift horse in the mouth. And it's quite possible no-one would attempt such a merge even if it was permitted by the license. [1] https://en.wikipedia.org/wiki/License_proliferation#License_compatibility https://en.wikipedia.org/wiki/License_proliferation#License_...
- bringtheaction 9y ago
  The license is MIT but not MIT. It’s the MIT license with two additional conditions imposed; - The one you mentioned about citation. - “The Software is not used by, in cooperation with, or on behalf of any armed forces, intelligence agencies, reconnaissance agencies, defense agencies, offense agencies or any supplier, contractor, or research associated.” https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/blob/master/LICENSE https://github.com/seemoo-lab/mobisys2018_nexmon_software_de... Even just the one about citation is problematic but IMO the condition about armed forces and so on is even worse. I kind of see where they are coming from but I wish people just used standard MIT and acknowledged that yes your software might end up being used for something that you do not agree with morally. And if they are going to impose such restrictions, why stop there? Why not also say that you cannot use the software to transmit for example child pornography? And how about saying that you cannot use it to spread false information, fake news etc? I would be exaggerating, but not much, if I were to say that as soon as you introduce one or more moral restrictions into a software license, you are implicitly saying that any moral concern not mentioned is ok. How about terrorism? They didn’t say anything about terrorism so I guess using their software for terror is fine as long as the terrorists are not an “armed force”, an intelligence agency etc. Technology has infitinite uses, a whole host of which are good, probably as many that are bad, and likewise an uncountable amount of uses that are either neither or both, and very many that will be one thing for some people and the other for other people. It should in my opinion not be the job of a software license to pass moral judgement. Either you release your software for anyone to use for any purpose under the terms of an unmodified license accepted by the community or you might as well not bother trying to be open source at all.
technofiend 9y ago
Considering the wildly varied performance of smartphone GPS implementations I'd love to use this to build my own WAAS emitter so that when me and 10 of my closest friends play ingress we're where we are supposed to be. But that would be based on using a higher accuracy source (think pucks that have better antennae, higher accuracy GPS chips and can see the other satellites as well). Unfortunately I don't think some people could ignore the potential for abuse. If only I could be 15 feet to the left where the other guy's crappy GPS puts him. At some point I'm hoping my city will put up a few WAAS transmitters to help in the glass canyon that is our downtown.
rsync 9y ago
What was required to achieve this result ? That is, what did these folks have to break in order to gain control of the wifi chip in this way ? How does this work compare to gaining (similar) access to the baseband processor on a phone ? There should be a bounty for that ...
kevin_b_er 9y ago
It is impossible for you to redistribute this software or any sort of resulting binary. It would be based on both their GPLv3 and their no-military licenses simultaneously. The linked requires another depot based on GPLv3 to function and perform patching. The resulting software would then undistributable as you cannot possibly comply with both the GPLv3 and their no-military license. GPLv3 would permit distribution to military and not permit you to restrict them and the other would prohibit military. Additionally this should be considered a violation of Gitbub's Terms of Use. It is intentionally discriminatory against another group: Any given military. For example, the content hosted on GitHub is intentionally discriminatory toward the Deutsches Heer.
rasz 9y ago
This is a continuation of a 2016 work on bcm4339 firmware. https://2016.mrmcd.net/fahrplan/system/event_attachments/attachments/000/002/897/original/nexmon_mrmcd16.pdf https://2016.mrmcd.net/fahrplan/system/event_attachments/att... RaspberryPee wifi chipset (BCM43438) is a close cousin and previous work (monitor mode, sending raw frames) was ported last year. https://dev.seemoo.tu-darmstadt.de/bcm/bcm-rpi3/tree/master/firmware_patching/nexmon https://dev.seemoo.tu-darmstadt.de/bcm/bcm-rpi3/tree/master/... so there is a chance this could to, it would mean $30 self contained 2.4/5 GHz SDR.

176 points by bcaa7f3a8bbc 9y ago

FPGAhacker 9y ago

Halfway to making a handheld radar.

dharma1 9y ago
What's the missing half?
- trelliscoded 9y ago
  Quadrature receiver.

drefanzor 9y ago

I'll stick with my RTL-SDR thanks :)

taxidump 9y ago
RTL-SDR is RX only.
- duskwuff 9y ago
  It also has much lower bandwidth than a wifi chipset. (And doesn't even get close to the 5 GHz range.)
- sliken 9y ago
  Try a limesdr then.
- zaarn 9y ago
  Personally, having an RX only SDR is sufficient, there is so much interesting stuff to listen too.

bcaa7f3a8bbc 9y ago

There are some interesting applications... Matthias Schulz, Jakob Link, Francesco Gringoli, and Matthias Hollick. Shadow Wi-Fi: Teaching Smartphones to Transmit Raw Signals and to Extract Channel State Information to Implement Practical Covert Channels over Wi-Fi. Accepted to appear in Proceedings of the 16th ACM International Conference on Mobile Systems, Applications, and Services, MobiSys 2018, June 2018. Matthias Schulz. Teaching Your Wireless Card New Tricks: Smartphone Performance and Security Enhancements through Wi-Fi Firmware Modifications. Dr.-Ing. thesis, Technische Universität Darmstadt, Germany, February 2018. But the papers are nowhere to be found. Just went through peer review and still waiting for public publication?

mirimir 9y ago
Secure mixnet using Android devices would be very cool.
- bcaa7f3a8bbc 9y ago
  Chaum's Store-and-Forward mixnet or Tor's Realtime Onion Routing? I think both can be built with Wi-Fi Direct on Android. But the end-point security may be less-than-ideal...
  - mirimir 9y ago
    I don't know. Maybe Riffle. Mostly it was the idea of using a custom spread-spectrum channel with strong encryption. Edit: + covert channels
pgeorgi 9y ago
> Matthias Schulz. Teaching Your Wireless Card New Tricks: Smartphone Performance and Security Enhancements through Wi-Fi Firmware Modifications. Dr.-Ing. thesis, Technische Universität Darmstadt, Germany, February 2018. might be coming soon. Feb 2018 is pretty recent, and publication is sometimes delayed due to procedural issues. However, it might just be "published" by having a number of copies in the university's (as well as the state's and German federal) libraries.

bigiain 9y ago

This opens up some exciting new ways to break radio spectrum laws! (I see the Raspberry Pi W is supported there... Hmmm...)

tlrobinson 9y ago
Or get a ham radio license and go wild (within the limits of that license)
- escherplex 9y ago
  You have a point. 23cm band gives you a bandwidth of 60MHz to play with. The 13cm (2.3-2.45 GHz) playground also happens to be within the frequency range of your microwave oven (2.45GHz) so experimenting with high ERP in that area will probably have physiological consequences.

xt00 9y ago

Only in WiFi bands.. so not super flexible as you would expect from an actual SDR rig.. or maybe I’m missing that it can actually transmit in other bands ?

bcaa7f3a8bbc 9y ago
Yes, Wi-Fi bands only.
trelliscoded 9y ago
RF compliance is really complicated in mobile devices, so there's all kinds of filters to prevent out of band emissions from being generated. The analog parts like the amplifiers are also precisely tuned to only use certain bands.
askvictor 9y ago
Is this a limitation of the antenna, or the hardware itself?
- makomk 9y ago
  Probably both. The antenna's designed for a specific band, and on top of it the actual frequency synthesis hardware is likely only designed to be capable of generating signals in certain bands, as are all the amplifiers etc.
userbinator 9y ago
This particular hardware may be limited to those frequencies but I believe the Mediatek combo chips that do WiFi+BT+GPS+GLONASS+Beidou+FM as well as GSM are capable of a much wider range. WiFi and BT are at 2.4GHz but GSM/UMTS/LTE reach up to 2.6GHz and down to 800-900MHz, and the various navigation systems use frequencies in the 1.x GHz range. From what I've read, only the FM hardware is different due to its vastly different frequency (76-108MHz, although the hardware could probably go beyond those ranges slightly) but everything else is based on the same SDR.
- xt00 9y ago

zokier 9y ago

This is exactly the sort of thing why FCC wants to lock down wlan ap/router firmwares. So, while a cool hack indeed, it is also bit unfortunate that it also kinda justifies FCCs position

jonashoechst 9y ago
I think this only shows the insanity of FCCs statement, as the Broadcom firmware _is_ locked down and got hacked either way. If somebody wanted to transmit arbitrarily on this bands he or she could just use regular SDRs.
- taneq 9y ago
  Or even just build a transmitter.
awalton 9y ago
Yeah that's not a strong argument at all. The 2.4GHz and 5GHz bands are known widely as "garbage bands" due to how terrible they are to work with (e.g. rain will heavily attenuate your signal, they're literally how microwaves work to cook your food, etc.). Moreover, there are plenty of radios on the market that transmit all kinds of noise on these channels that isn't WiFi (e.g. my neighbors had a baby monitor that I could tell when it was on by how shit my WiFi was at that moment, FPV drones somewhat frequently use this band with proprietary analog video transports, etc.) This is permitted because these channels are "unregulated" (or, more realistically, "regulated for unlicensed operation"). On top of that, the FCC's official statement on this very topic was that what they really care about is the amount of power being put into these channels, as some aftermarket router firmwares of varying repute would let you crank the output wattage above FCC regulations for these frequencies (<1W power to stay within unlicensed operation regulations for 2.4GHz), and apparently some in-market WiFi routers picked up those firmwares as a "supported" option (I think ASUS and Linksys were both named). Most of these routers have since patched themselves to stay regulation-safe. So, go nuts, just stay below 30 dBm/1W from the transmitter in 2.4Ghz channels or prepare for a visit from the FCC. (You'll have to do your own research for 5GHz).

Y_Y 9y ago

Nice to see that instead of a free license they've opted for a bullshit made-up one where they want you to cite their papers.

matthewmacleod 9y ago
Why is that “bullshit”?
- michaelt 9y ago
  License proliferation leads to complicated license compatibility relationships [1]. Imagine someone wanted to, say, provide native support in GNUradio - as has been done for the RTL-SDR. It's impossible unless you relicense one or the other. Of course, the code's being given away for free; you could argue one shouldn't look a gift horse in the mouth. And it's quite possible no-one would attempt such a merge even if it was permitted by the license. [1] https://en.wikipedia.org/wiki/License_proliferation#License_compatibility https://en.wikipedia.org/wiki/License_proliferation#License_...
bringtheaction 9y ago
The license is MIT but not MIT. It’s the MIT license with two additional conditions imposed; - The one you mentioned about citation. - “The Software is not used by, in cooperation with, or on behalf of any armed forces, intelligence agencies, reconnaissance agencies, defense agencies, offense agencies or any supplier, contractor, or research associated.” https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio/blob/master/LICENSE https://github.com/seemoo-lab/mobisys2018_nexmon_software_de... Even just the one about citation is problematic but IMO the condition about armed forces and so on is even worse. I kind of see where they are coming from but I wish people just used standard MIT and acknowledged that yes your software might end up being used for something that you do not agree with morally. And if they are going to impose such restrictions, why stop there? Why not also say that you cannot use the software to transmit for example child pornography? And how about saying that you cannot use it to spread false information, fake news etc? I would be exaggerating, but not much, if I were to say that as soon as you introduce one or more moral restrictions into a software license, you are implicitly saying that any moral concern not mentioned is ok. How about terrorism? They didn’t say anything about terrorism so I guess using their software for terror is fine as long as the terrorists are not an “armed force”, an intelligence agency etc. Technology has infitinite uses, a whole host of which are good, probably as many that are bad, and likewise an uncountable amount of uses that are either neither or both, and very many that will be one thing for some people and the other for other people. It should in my opinion not be the job of a software license to pass moral judgement. Either you release your software for anyone to use for any purpose under the terms of an unmodified license accepted by the community or you might as well not bother trying to be open source at all.

technofiend 9y ago

Considering the wildly varied performance of smartphone GPS implementations I'd love to use this to build my own WAAS emitter so that when me and 10 of my closest friends play ingress we're where we are supposed to be. But that would be based on using a higher accuracy source (think pucks that have better antennae, higher accuracy GPS chips and can see the other satellites as well). Unfortunately I don't think some people could ignore the potential for abuse. If only I could be 15 feet to the left where the other guy's crappy GPS puts him. At some point I'm hoping my city will put up a few WAAS transmitters to help in the glass canyon that is our downtown.

rsync 9y ago

What was required to achieve this result ? That is, what did these folks have to break in order to gain control of the wifi chip in this way ? How does this work compare to gaining (similar) access to the baseband processor on a phone ? There should be a bounty for that ...

kevin_b_er 9y ago

It is impossible for you to redistribute this software or any sort of resulting binary. It would be based on both their GPLv3 and their no-military licenses simultaneously. The linked requires another depot based on GPLv3 to function and perform patching. The resulting software would then undistributable as you cannot possibly comply with both the GPLv3 and their no-military license. GPLv3 would permit distribution to military and not permit you to restrict them and the other would prohibit military. Additionally this should be considered a violation of Gitbub's Terms of Use. It is intentionally discriminatory against another group: Any given military. For example, the content hosted on GitHub is intentionally discriminatory toward the Deutsches Heer.

rasz 9y ago

This is a continuation of a 2016 work on bcm4339 firmware. https://2016.mrmcd.net/fahrplan/system/event_attachments/attachments/000/002/897/original/nexmon_mrmcd16.pdf https://2016.mrmcd.net/fahrplan/system/event_attachments/att... RaspberryPee wifi chipset (BCM43438) is a close cousin and previous work (monitor mode, sending raw frames) was ported last year. https://dev.seemoo.tu-darmstadt.de/bcm/bcm-rpi3/tree/master/firmware_patching/nexmon https://dev.seemoo.tu-darmstadt.de/bcm/bcm-rpi3/tree/master/... so there is a chance this could to, it would mean $30 self contained 2.4/5 GHz SDR.