Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 12, 2017 12:58 UTC (Wed) by excors (subscriber, #95769)
In reply to: Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero) by peter-b
Parent article: Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

The first blog post links to this bug which includes exploit code for Nexus 5, so at least some versions are vulnerable. The Android Security Bulletin for April 2017 says the "Remote code execution vulnerability in Broadcom Wi-Fi firmware" was fixed in Nexus 6, Nexus 6P, Nexus 9, Pixel C, Nexus Player. But there's no mention of a fix for Nexus 5, so it sounds like the latest version is probably still vulnerable. And you can't fix it by using a more recent AOSP derivative since the bug is in the firmware blobs.

Google says "Nexus devices get security patches for at least 3 years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer". Apparently the Nexus 5 was first released 3.5 years ago, and discontinued 2 years ago, so it's outside that period.

Now is probably a good time to send your phone off for recycling and buy a new one.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 12, 2017 15:50 UTC (Wed) by peter-b (subscriber, #66996) [Link]

Thanks, that's extremely helpful. I now have a new phone on the way!

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 12, 2017 16:53 UTC (Wed) by NightMonkey (subscriber, #23051) [Link] (8 responses)

What a sad state of affairs that you have to throw away perfectly good hardware because of a firmware problem. :(

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 13, 2017 3:54 UTC (Thu) by pabs (subscriber, #43278) [Link]

We really need 'Right to Repair' laws for software...

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 13, 2017 9:18 UTC (Thu) by linusw (subscriber, #40300) [Link] (1 responses)

This is one of the main reasons why all hardware should have upstream drivers.
The hardware has a future there.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 13, 2017 10:32 UTC (Thu) by excors (subscriber, #95769) [Link]

Upstream kernel drivers don't help when the vulnerabilities are in proprietary firmware.

You could argue that all hardware should have open source firmware (and provide a free toolchain to build it, and have some way of disabling signature checks so your hardware will accept your modified version, etc), to allow community maintenance after it's officially unsupported. Seems unlikely to happen though, since there are significant costs and essentially no benefits for the people who would have to make that decision.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 13, 2017 12:28 UTC (Thu) by peter-b (subscriber, #66996) [Link] (3 responses)

I was going to sell my Nexus 5 to a second hand phone shop, but now I worry that that would be professional misconduct. As a professional software engineer, and with the knowledge that the device has unpatchable remotely-exploitable security bugs, I am probably ethically required to ensure that it is removed from circulation. Would be interesting to hear your views.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 14, 2017 1:34 UTC (Fri) by bronson (subscriber, #4806) [Link] (2 responses)

Caveat emptor. Since it's still available on Amazon/Newegg/etc, I don't think a principled stance here will make any difference. But do whatever lets you sleep well at night. :)

Frankly, I expect every Android phone 3+ years old is just riddled with security holes. Every last one. (maybe the tiniest exception exists for Lineage/Cyanogen... maybe)

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 14, 2017 7:34 UTC (Fri) by peter-b (subscriber, #66996) [Link] (1 responses)

> Frankly, I expect every Android phone 3+ years old is just riddled with security holes. Every last one. (maybe the tiniest exception exists for Lineage/Cyanogen... maybe)

I don't doubt you. Frankly, being a software engineer in 2017 is getting to be pretty embarrassing. The horrendously low standard of engineering in this industry's race to the bottom is giving us all a bad name.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 18, 2017 14:42 UTC (Tue) by ortalo (guest, #4654) [Link]

You are pretty right. And not only embarrassing, worrisome given the spread of software to critical systems.
The last decade brought me gray hair at a fast pace ; and that's probably not only due to age.
And honestly, apart from fingerpointing, I am still wondering what to do to stop the down ride...
"Desperate Software Engineers" would probably not even make a decent TV show.

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 24, 2017 14:20 UTC (Mon) by paulj (subscriber, #341) [Link]

If only there was a software licence that was intended to ensure end-users could always update their devices, and people enforced it...

Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2) (Project Zero)

Posted Apr 13, 2017 13:49 UTC (Thu) by JFlorian (guest, #49650) [Link]

I have zero evidence, nor even suspicion necessarily, but it would seem to Google's advantage to withhold info of such an exploit long enough to ensure they're not responsible for a massive hardware recall due to a firmware issue such as this. While purely hypothetical, it does not paint a pretty picture for the security minded. My hope is they can apply pressure on their suppliers who resort to such closed firmware as a means for reducing their own risk exposure.