Bugs in billions of WiFi leads to password and data theft

Researchers from Darmstadt University of Brescia, CNIT, and the Secure Mobile Networking Lab, have discovered security vulnerabilities in WiFi chips that can be exploited to extract passwords and manipulate traffic on a WiFi chip by targeting a device’s Bluetooth component. Modern consumer devices such as smartphones or tablets have single-chip systems (SoCs) with separate Bluetooth, Wi-Fi and LTE modules, each with their own security implementation.

Most often, however, these components share the same resources, such as the antenna or the frequency spectrum. Due to this, the developers manage to make the SoC more energy efficient. In addition, throughput is increased and data transmission delays are reduced. The researchers said that the shared resources of wireless modules can be in use by attackers as bridges to launch privilege escalation attacks. After carrying out such an attack, an attacker can remotely execute code on the target device; as well as read data from memory and affect its performance.

The researchers have detailed in a recently published paper that it is possible to use these shared resources as bridges for launching lateral privilege escalation attacks across wireless chip boundaries. Researchers have worked with a variety of wireless adapters from Broadcom, Cypress and Silicon Labs; that are in use in billions of electronic devices around the world. All vulnerabilities found are reported to the vendors, and some of them release appropriate security fixes whenever possible.

However, not everyone does this, since in some cases the support period for devices has already ended; or it is simply impossible to fix the problem with software patches. The implications of these attacks include code execution, memory readout, and denial of service. While the code execution vulnerability is rooted in architectural issues of specific chips and uncovering required reverse-engineering efforts, DoS and information disclosure attacks of a more general nature can directly be derived from the openly available coexistence specifications.” concludes the paper. “Wireless coexistence enables new escalation strategies based on hardwired inter-chip components. Since the attack vector lies directly between the chips, it bypasses the main operating system. A full fix will require chip redesigns-current firmware fixes are incomplete”