A wide range of Android devices are vulnerable to attacks that use captured Wi-Fi signals to successfully hack the device, a researcher says.
The vulnerability is in a widely used Wi-Fi chipset made by Broadcom and used in both iOS and Android devices. Apple is patching the vulnerability with the release of iOS 10.3.1 on Monday. “A remote attacker could be able to execute arbitrary code on the Wi-Fi chip,” Apple advises. In a highly detailed blog post published by the Google Project Zero researcher who discovered the flaw, he said it allowed malicious code to run on a fully updated 6P “on Wi-Fi only, without requiring any user interaction.”
Google is in the process of releasing a new update to its April security bulletin. The patch is only available to a select number of device models, and even then it could take up to two or three weeks to be available as an over-the-air update to those devices that are eligible.
In addition to specific bugs in the chipset, Beniamini said that the lack of security protections built into many software and hardware platforms made the Broadcom chipset a prime target for hackers.
The Broadcom chipset contains an MPU, but the researcher found that it is implemented in a way that makes all memory recognizable, writable, and executable. “This saves us a lot of hassle. We can easily execute code directly,” he wrote. He said Broadcom informed him that newer versions of the chipset will be more efficient and will also add unspecified additional security mechanisms.
