3 ms·

Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08

Checkpoint's release for these vulnerabilities is here https://blog.checkpoint.com/2020/08/06/achilles-small-chip-big-peril/ https://blog.checkpoint.com/2020/08/06/achilles-small-chip-b... not clear from the writeup how many devices are affected. They fuzz-tested 'a DSP chip' (sounds like just one) and then say that Qualcomm products are used in 40% of devices. press release focuses on exfiltrating media + GPS, not clear if this is a rootkit that can access the keyboard or take over your email. 'more than 400 vulnerable pieces of code were found' not clear to me -- maybe I don't know how fuzzing DSPs work? Do they have access to the source code because the image decoder is open source?

wyldfire 6y ago
The qemu linux userspace implementation for hexagon is recently available and open source, yes. Not sure whether it would've been any harder to do fuzzing with the closed-source simulator that's been available for a long time. But the fuzzer doesn't need the libraries' source, it just makes it easier for the fuzzer if it has access to the source. And the availability of emulator or simulator code is probably independent of this too. The 400 distinct bugs are the uniquely faulting instructions or paths uncovered by the fuzzer.