Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets

Рет қаралды 147,828

Күн бұрын

Meet Broadpwn, a vulnerability in Broadcom's Wi-Fi chipsets which affects millions of Android and iOS devices, and can be triggered remotely, without user interaction. The Broadcom BCM43xx family of Wi-Fi chips is found in an extraordinarily wide range of mobile devices - from various iPhone models, to HTC, LG, Nexus and practically the full range of Samsung flagship devices.
By Nitay Artenstein
Full Abstract & Presentation Materials:
www.blackhat.com/us-17/briefi...

Пікірлер: 88

@sent4dc 6 жыл бұрын

Pretty cool. But one suggestion: watch on 1.5 or 1.25 speed.

@einsteinx2 5 жыл бұрын

sent4dc not only was it way better to watch that way, but I had no idea until now that you could increase playback speed in the KZfaq app! Thanks!!

@easyappsmarketingestudio2408 5 жыл бұрын

SHIT MAN YES ITS SO SLOW

@easyappsmarketingestudio2408 5 жыл бұрын

The worst thing cannot see on 1.25

@Miawgician 4 жыл бұрын

now he rapping hahaha

@tayloro_o6448 4 жыл бұрын

thanks much appreciated

@ZarkowsWorld 4 жыл бұрын

And NSA and China's 'Cyber warefare' divisions have used this and not notified Broadcom as it is very useful for them.

@maximalgamingnl9954 4 жыл бұрын

just imagine sitting in a Software Engineering class, and just 2 people there having macs, then you say 'Your laptops will crash in 10 seconds', and then you do something like this: 31:00 xD

@bitcode_ 6 жыл бұрын

Repository unavailable due to DMCA takedown.

@changdi2042 6 жыл бұрын

Mark at: 28:58 (Auto-Join a new & untrusted Wifi) 46:00 (the Demo starts)

@keysless4158 6 жыл бұрын

666666666

@TurboWindex 2 жыл бұрын

The only time I like to hear "Game Over" is at a black hat presentation.

@blackneos940 5 жыл бұрын

The OpenBSD Devs would LOVE this video..... (:

@johnnyprimavera2 6 жыл бұрын

One of the slowest talks I've ever seen. Really interesting though.

@ColtonBs 6 жыл бұрын

Joan Montserrat so slow that I’m already bored from watching it. How many times can someone repeat what they’re saying in a different way before you’re tired of hearing them? Less than 10 minutes in and I’m already over it.

@Adam-eb3rs 6 жыл бұрын

Colton B ummmm aarrrrrrmmmm ummmmmmmm ummmmmmm jesus

@nullablebool 6 жыл бұрын

I just watch it with a 2x playback speed.

@judgeomega 6 жыл бұрын

I keep my speed at least at 1.25, often at 1.5. Time is the most valuable commodity in the world.

@ColtonBs 6 жыл бұрын

Could have been half the length if he had a full presentation ready, instead of long periods of silence and “um” being used almost every other phrase. He spent more time on his slides than figuring out what to say with the slides. Very disappointed with this speaker, and I hope that Black Hat refuses any of his future talks unless he is actually prepared.

@RalphInRalphWorld 6 жыл бұрын

Good thing the firmware is closed source to prevent this sort of thing...

@firefly618 6 жыл бұрын

lol

@yurigeinish3018 6 жыл бұрын

Security by obscurity doesn't work.

@SkyGodKing 5 жыл бұрын

Well you could argue if they stopped the source code from being leaked then this exploit wouldn't have been discovered

@BibendiYT 5 жыл бұрын

It wouldn't been discovered YET

@MultiClittle 5 жыл бұрын

Yuri Geinish - is joke

@SeoKungFu 6 жыл бұрын

Lovely #PWNAGE !

@ak_as_gamer942 6 жыл бұрын

owesome attack really helpful

@bencesarosi7718 5 жыл бұрын

This is a very interesting project. Thing is, however, he/they didn't ever compromise Android, nor iOS, thus the title is absolutely misleading. The content is still very worthy and thought-inducing IMHO, but indeed doesn't justify the full hour presentation time people are complaining about.

@gradertfamilymakes 5 жыл бұрын

It's not apparent to you that access in this memory could allow for code to be executed within the OS of the phone correct?

@bencesarosi7718 5 жыл бұрын

Didn't really delve more into it than what is already presented here, but as far as my understanding goes, the code you get to run here runs on a dedicated ARM unit, in dedicated memory, belonging exclusively to the WiFi chipset. That is, you'll need at least one other vulnerability concerning the interface between this chipset and the OS in order to get the main CPU running the system to execute your payload in the context of the OS. It's a really interesting possibility, but apparently it is just as far from compromising Android/iOS as is an SQL injection from hijacking the whole system the website is hosted on. Nevertheless it opens up some new perspectives...

@Baigle1 6 жыл бұрын

could this brick the broadcom chip if done wrong or purposely?

@Baigle1 6 жыл бұрын

i can definitely see a firmware attack used out of this if its even possible... like the hdd firmware patching modules that were unfinished in stuxnet back when it was running around with 0-days and who knows what is in intel amt/me or amd psp/secure processor to flash.. the intel amt memory region on motherboard is the same as smm code the ultimate persistence would be hardware or firmware..

@Ratzzo 6 жыл бұрын

maybe. if you inject code in ram and call flashing facilities

@statinskill 5 жыл бұрын

Sure. If you can find something important you can overwrite, a flash or a serial eeprom maybe. It probably won't work without a proper config. That said, why would you? There's nothing to be gained from this, all it means is they will ditch the phone they're using and get a new one. Maybe one where this doesn't work.

@abdelrahmangamalmahdy 5 жыл бұрын

I am just wondering why he didn't inject any system calls to compromise the android/ios system itself.. All I'm seeing is just taking over the wireless chip but not the application system itself. I think it is very possible to use the trust-relationship between the wifi software and other system resources to hack the application software.. so this seems like an incomplete project or maybe he has already sold such attack privately to a company or possibly a government!

@TopherSnags 5 жыл бұрын

Truth Seeker I was wondering this as well.

@Atomkukac1 4 жыл бұрын

Probalby 24 bytes are not enough and you need to at least dupicate potential system calls to cover both iOS and Android. Rule2: No assumptions of the system.

@nosimpingnocap 2 жыл бұрын

He talking about Pegasus

@AmeerHamza-cy6km 5 жыл бұрын

thanks for speaking this way , so people who do not speak English can easily understand .

@kuqezi8081 4 жыл бұрын

I had to grin when I saw the whoami at the beginning 00:30 :)

@pubcollize 6 жыл бұрын

It's not even 3 minutes in and he said "remote exploit" at least over 9000 times.

@coprice94 4 жыл бұрын

Glad I use flip phone

@blackfoxshooter 4 жыл бұрын

cool jacket

@zedeleyici.1337 2 жыл бұрын

mükemmel

@LostArchivist 4 жыл бұрын

So they are spooks basically. And they play by old-school rules.

@jakubrichnavsky 6 жыл бұрын

50000 against milions

@localhost9993 5 жыл бұрын

exploit link............./

@RahilKhan-ym9ej 2 жыл бұрын

@ChillSakura yaa 😂😂he need the link?? how

@remusomega 6 жыл бұрын

Wasn't this exploit already patched by apple?

@Tjalian 6 жыл бұрын

Probably. A lot of these exploits that are released at Blackhat after the time of reasonable disclosure has past, which gives plenty of time for developers to patch the exploits. If you're dragging your heels on patching the exploit, that's their problem, not his.

@coprice94 4 жыл бұрын

@EAGEEYE321 2 жыл бұрын

aaahhhh

@livefreeprintguns 6 жыл бұрын

Save yourself the 40 minutes and jog straight to 40m00s. Unless you want a lecture on what a "remote exploit" is (which I always thought was inherent) and in case you missed out on the past 20 years, a 30 minute tutorial on how WiFi works. It's literally a 10 minute demo stretched out to an hour of mostly yawnzzzzz.

@kellysmith7357 2 жыл бұрын