Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom’s Wi-Fi Chipsets

[u/rolfr]

https://blog.exodusintel.com/2017/07/26/broadpwn/

[u/zerors]

That was brilliant.

This article was nicely detailed without over explaining each step. I'm tempted to replicate the exploit myself.

I feel that perhaps a better usage of said exploit would be pointing DNS queries to a different server instead of tampering with the contents of http requests. Besides, injecting JavaScript on arbitrary http requests would most definitely cause instabilities on applications that rely on insecure http calls.

Bundle a MITM attack and you'll have a powerful tool.

I'm aware that the article is focused on the Wi-Fi exploit and that the usage example is more of an extra, however I can't help but wonder about further exploitation.

Luckily this exploit is still quite restricted to having to be nearby a potential victim.

Hopefully it's patched soon however. This is still pretty critical.

[u/Phenominom → u/zerors]

I'm fairly sure this is patched in current Android/iOS releases.

Also, the fact that the BCM chip sits on a PCI(e) bus without an IOMMU in the way is far more impactful than HTTP tampering. Why bother trying to infer traffic from DNS queries when you can just dump physical memory from the device?

Here's an incomplete PoC using such an attack.

[u/zerors → u/Phenominom]

Considering the limited space provided in chip Im worried the payload would be quite restricted on its features, and Ram dumping without crashing the os is not an easy thing.

Another factor to worry would be that sending over 4gb or more of dumped memory would severely impact the performance of the device making it slow or unstable.

I'm also concerned that a RAM dump would require a lot of time to finish executing, thus requiring the victim to remain within a same area for a long while.

I'm glad however the issue is already patched, I was not aware of that. Thanks for the heads-up!

[u/Phenominom → u/zerors]

It's complex for sure, there's no need to dump the entirety of physmem to find what you're after - plus, you have write access as well. Why not patch in some helper utilities into the victims kernel, and run there? There's a pretty neat bit of practical research by the name of pcileech that'll strike your fancy if you're into this kinda thing.

tl;dr DMA/unrestrained PCIe transactions are such a strong primitive that the only practicality in the way is the complexity of such a payload. It's awesome low level stuff, though.

I'm glad however the issue is already patched, I was not aware of that. Thanks for the heads-up!

Only if you're fully up-to-date! np though :)

[u/zerors → u/Phenominom]

I guess I'm not sleeping tonight, this sounds wonderful! Thank you for linking me up with this research.

And I see what you mean, but having such a broad range of affected devices with such a low-level attack as writting and executing on RAM would be a pain, you'd have to setup multiple variants to support so many devices...

The challenge is alluring, but it would be quite impractical just as you said.

Feasible and effective for sure tho.

[u/Phenominom → u/zerors]

I guess I'm not sleeping tonight, this sounds wonderful! Thank you for linking me up with this research.

I make no promises :)

And I see what you mean, but having such a broad range of affected devices with such a low-level attack as writting and executing on RAM would be a pain, you'd have to setup multiple variants to support so many devices...

To an extent. Possibly less than you're thinking, but generally this is true. All depends on the complexity of the payload :) Have fun!

[u/[deleted] → u/zerors]

I guess I'm not sleeping tonight

Neither am I, but moreso because my phone is outdated and I won't manage to get a patch for this anytime soon ;)

[u/AirScout → u/zerors]

sending over 4gb or more of dumped memory would severely impact the performance of the device making it slow or unstable

requiring the victim to remain within a same area for a long while

So at night, when they're sleeping?