Slashdot Mirror
Firmware Vulnerability In Popular Wi-Fi Chipset Affects Laptops, Smartphones, Routers, Gaming Devices (zdnet.com)
Embedi security researcher Denis Selianin has discovered a vulnerability affecting the firmware of a popular Wi-Fi chipset deployed in a wide range of devices, such as laptops, smartphones, gaming rigs, routers, and Internet of Things (IoT) devices. According to Selianin, the vulnerability impacts ThreadX, a real-time operating system that is used as firmware for billions of devices. ZDNet reports: In a report published today, Selianin described how someone could exploit the ThreadX firmware installed on a Marvell Avastar 88W8897 wireless chipset to execute malicious code without any user interaction. The researcher chose this WiFi SoC (system-on-a-chip) because this is one of the most popular WiFi chipsets on the market, being deployed with devices such as Sony PlayStation 4, Xbox One, Microsoft Surface laptops, Samsung Chromebooks, Samsung Galaxy J1 smartphones, and Valve SteamLink cast devices, just to name a few.
"I've managed to identify ~4 total memory corruption issues in some parts of the firmware," said Selianin. "One of the discovered vulnerabilities was a special case of ThreadX block pool overflow. This vulnerability can be triggered without user interaction during the scanning for available networks." The researcher says the firmware function to scan for new WiFi networks launches automatically every five minutes, making exploitation trivial. All an attacker has to do is send malformed WiFi packets to any device with a Marvell Avastar WiFi chipset and wait until the function launches, to execute malicious code and take over the device. Selianin says he also "identified two methods of exploiting this technique, one that is specific to Marvell's own implementation of the ThreadX firmware, and one that is generic and can be applied to any ThreadX-based firmware, which, according to the ThreatX homepage, could impact as much as 6.2 billion devices," the report says. Patches are reportedly being worked on.
"I've managed to identify ~4 total memory corruption issues in some parts of the firmware," said Selianin. "One of the discovered vulnerabilities was a special case of ThreadX block pool overflow. This vulnerability can be triggered without user interaction during the scanning for available networks." The researcher says the firmware function to scan for new WiFi networks launches automatically every five minutes, making exploitation trivial. All an attacker has to do is send malformed WiFi packets to any device with a Marvell Avastar WiFi chipset and wait until the function launches, to execute malicious code and take over the device. Selianin says he also "identified two methods of exploiting this technique, one that is specific to Marvell's own implementation of the ThreadX firmware, and one that is generic and can be applied to any ThreadX-based firmware, which, according to the ThreatX homepage, could impact as much as 6.2 billion devices," the report says. Patches are reportedly being worked on.
Spent over a month researching popular wifi adapters. Not even once dit I find an adapter using any model of chipset from Marvell. So the claim that this chipset model is very popular is bull.
On the midrange side, Realtech chipsets (which have crappy drivers) were the king.
Enjoy some of the security of ethernet.
Domestic spying is now "Benign Information Gathering"
See subject: Everyone who assumed I'm responsible for posting this anti-Jew spam is correct. I'm a bitter, hateful little man & I'm ashamed of myself. I won't do this again.
* Jews are wonderful people but I attack them because I have a MASSIVE inferiority complex. I'm wrong & I'm SORRY for flooding /. with this drivel. I won't do it again. I shouldn't be stalking amicusNYCL, either & I'll stop.
I'm also SORRY for flagrantly SHITPOSTING about my third rate string concatenation & sorting program. It's all I have to show for life & I'm in my mid 50s.
APK
P.S.=> I truly am a garbage human being... apk
Patches are reportedly being worked on.
Since when are any of these consumer devices' firmware actually upgradable??
Maybe we need to have manufacturers buy everyone new devices so they'd actually learn their lesson.
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
Go hang yourself.
https://rtos.com/news/express-...
Once again proving, the only way to safely use C is by only hiring 200 IQ coders who have been developing firmware for 30 years and have never created an exploitable bug in their entire life. Like all the developers who will argue me on this ... there's just not enough of you guys to go around though.
So by this logic Java is also not safe for anyone to use either, no?. You didn't forget that the massive Equifax hack was due to a remote code execution vulnerability in Apache Struts which is written entirely in Java, right?
https://blogs.apache.org/found...
Oh and back in August 2018 there was this other beauty of a bug in Apache Struts:
https://threatpost.com/apache-...
I bet the flaws exploited in the 100%-Java-code Apache Struts has caused far more widspread harm to consumers than this WiFi firmware bug.
Oh and here's an RCE flaw in 100%-Java-code Apache Tomcat:
https://threatpost.com/apache-...
If even the Apache Foundation can't right secure Java code why should we expect an average-skilled Java coder is able to?
This game is fun. Shall I start listing comparable security bugs in software written in Ruby, Python and other such supposedly "safe" langauges?
Oh and even Heartbleed can claim but a small fraction of the damage that the Struts bug did with the breadth of the Equifax breach.
If I'm reading this correctly, the blame for these exploits is being squarely placed on this ThreadX RTOS thing.
Well, you signed up for proprietary operating system, this is what you get when you do that. This is the downside of using code you can't look at and assess yourself, or have it assessed by professionals. You just have to take their word for it that it's security, stable and good. Obviously, this particular proprietary operating system is not secure.
Must say, I'm mildly surprised. Checking out ThreadX RTOS website, they seem to have all sorts of fancy certifications which I have no idea what mean, but surely they mean something? Just not secure and exploit free operating system?
Type errors are unavoidable, buffer overflows are unavoidable in (MISRA) C.
If there is even a remote possibility of using this to own current gen consoles remotely then I'd expect patches within days not weeks. Imagine wardriving your local neighborhood and gaining WiFi access to any house with a games console in five minutes. Perfect for the TLAs though eh.
Certified by SGS-TUV Saar for use in safety-critical systems and achieved EAL4+ Common Criteria security certification. Oops. There goes your pacemaker.
Got any for C#?
NSA and peer agencies: Good news! The system is working as intended!
And yet, the Struts vulnerability caused massively more damage to more people.
[quote]Type errors are unavoidable,[/quote]
And yet in the real world they aren't as numerous CVEs can attest. I can also find numerous other causes of security vulnerabilities due to SQL injection, etc. as well. All in software supposedly written by the cream of the crop of these "safe" languages.
It's almost as if the entire base of your argument is bullshit.
You seem to really be obsessing over this issue.
It's like arguing that cars shouldn't have safety belts and airbags, since you can never rule out the chance that you might die of a heart attack wile you're driving.
Oh yeah, SQL has been nearly as destructive as C ... no argument there. The native use of it in web front ends makes certain types of disastrous errors very easy to make.
> they seem to have all sorts of fancy certifications which I have no idea what mean, but surely they mean something?
Mostly they mean that you can depend on it running perfectly reliably, so you can trust your $300 million space probe to ThreadX.
You may have also noticed ThreadX takes 2KB of memory.
When your system requirements are the kind of thing ThreadX is designed for, you don't have a ton of options. Maybe three will be worth considering, and likely one will be the best fit, just on technical considerations.
You can interpret data in an incoming packet as code for a domain language in any programming language. There is no language feature which caused this and for which alternatives have been actively researched for decades but held back by curmudgeons.
The same can not be said for buffer overflows.
He was right, you're a fucking idiot. Stop being a chink goof.
It makes me wonder if they really needed an RTOS for this. In my experience often the RTOS is just a crutch for programmers who don't know how to survive without an OS. It's actually needed for what they want to do, and in fact tends to just make things worse.
Of course there are times when you want one. Stuff that takes a long time and which you can't easily break up into smaller steps, which wifi stuff seems like it might be a good fit for.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Driver auto safety constraints increase by 11% age-challenged oldsters chances of heart-attack while driving. Not-nice to increase pressure on decrepit blood-flow.
Any state machine can be considered as an "operating system", actually. Even very simple CMOS chips have undefined states that are undocumented, and that can possibly exploited to make the chip do something it is not expected to do. This is an "OS hack".
The problem with a wifi chip is that an exploit can lead to exposure of valuable information - information is sent unencrypted between the CPU and the chip, and can be extracted. Specifically, wifi passwords. Once you get access to a wifi password, you can connect to the wifi network using a normal computer and have fun.
the only way to safely use C
I know. Our firmware should be coded by highschoolers using Rust. Then it'll be 100% bug free and safe.
Abstraction adds safety. The closer to your hardware you get the more complicated and quirky edge cases you need to handle and debug. The library principle applies here too. e.g. you don't want every idiot reinventing openssl the end result would be very bad. Instead by abstracting yourself and building on the platform of others you have not only reduced the chance of bugs in your code, you've increased consistency between your products and platforms while also dramatically simplifying the process of bug fixing.
That's it.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Firmware relevant to your well-being will get coded by the equivalent of those highschoolers any way. You celebrate the continued use of C and giving those kids all the tools to harm you with. I think the necessity for replacing C in most fields should have been clear to the industry since before the current crop of highschoolers was born.
A good assumption when designing an IoT device is this: At some point a bug will be found that allows remote execution of malicious code on the chip that handles the communications with the outside world. You need to take this into account and design accordingly.
Split the tasks between a physically separate communication processor and another chip responsible for the rest of the functionality of the IoT device. Take into account that the communication processor might try to make a denial-of-service attack through the bus connecting it to the main processor.
Security by layers. A succesful attack against the outer layer should not compromise everything. Saving a few dollars here is no reason to use the same processor for everything.
Take away people's guns and they'll just stab you. Your notion that if avoid writing in C (especially in low level systems like this) everything will be better is just stupid.
Putting on a seat belt doesn't limit your car to 10kph while using 10x as much gas.
Then proceeds to only list a few devices using that chipset, not a complete list.
What the fuck are we supposed to do with this information?
#DeleteFacebook
Guess what chipset the newest HP printers are using?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
That works on bigger systems where you have hardware support for abstraction, things like memory protection.
Without it the abstraction doesn't help. A bad pointer can still trash another task. Maybe other tasks can still run even if one hangs, but now you need a two level watchdog system to save that task and to save the OS in case that gets stuck.
As for libraries, sure for openssl, but does openssl need an RTOS just to be ported? And are you going to maintain that port? Makes more sense to shove stuff like that further up the chain into the real OS, not run it on the embedded processor.
Testing can be very difficult with an RTOS. Timing changes as tasks go active and inactive. It's near impossible to get 100% coverage of all possible timing patterns and interactions.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Sigh. These devices are full blown, relatively powerful, though purpose built, computers. They have the capacity to steal and store data, then send the data to the operator of the malware installed via this exploit.
The good news is that the companies using them are big enough to demand a firmware fix, or mitigate the issue in a patch to the OS if an update isn't possible.
Still...#pcmasterrace
A bad pointer can still trash another task. Maybe other tasks can still run even if one hangs, but now you need a two level watchdog system to save that task and to save the OS in case that gets stuck.
What we could do is collect all of these functions in a common structure and run it on our hardware. Let's give it a fancy name like "Operating System".
While there aren't many sources for devices with Atheros chipsets today based around these drivers/firmwares there is a complete set of source code available thanks to ThinkPenguin's efforts and they still do sell wifi adapters and cards with these chipsets. Unfortunately none of the newer chips have a complete set of source code available and nobody has been cooperative in releasing a complete set of code. The FCC didn't help things either by mandating router lock downs. And no matter what BS propaganda that is effectively what was required even if the wording was otherwise and companies deceived users into thinking that they solved this problem. Making something read-only does not really solve the problem as you still are executing code that you not have from a security and privacy perspective. You still don't have full control over your own devices.
Selianin in Bulgarian means " Red neck", so he is Denis Redneckski
It makes me wonder if they really needed an RTOS for this.
Running on an RTOS ENORMOUSLY simplifies things when you have multiple, independent (or mostly independent), things you have to manage in real time.
The task or task set managing each of these independent things can be written without regard for any of the other stuff going on, except for those tiny and well-contained places where it must communicate with another task handling something related. Meanwhile the OS handles the resource allocation, scheduling, and inter-task communication.
With a good set of patterns to program to, everything gets broken into simple and tiny pieces, small enough to understand and make reliable. The simplicity letts you avoid gobs of on-the-fly checking program bloat, and get a lot done very quickly with minimal resource.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Your entire argument is a strawman. You're cherry picking random examples instead of looking at overall stats. The rates and ease of creating security bugs in these couple languages far exceeds other languages. They should not be used how they're being used. There are better options out there and if for some reason there isn't, then make one.
Well obviosly, orherwise they would not fit in the slotrs/ readers, I think the poster you responsed to meant capasety not physical size,I often mske that simplifixcation myself since moste storrage nedia comes b a standard form factor (have you for instance seen any sata ssds, not counting m.2 ans pcie ,that where anything other then 2.5inches wide) ? I admit it is technicaly innscurate to say size when you mean capacity, but unfortunatly making people care is about as easy as making the US change to the metric system or even to chsnge from messuring temprature in faranheit to selcius (pesonaly I tend to find mertic and celsius more convinient could just be habit at list for temprature but when it comes to other mesurements netroc just makes conversion between units simpler example one liter = (.1)^3m^3, or 1m^3 =1000 liters ,now how many pints are there in a cubic yard again? Woops went a bit ot there sorry about that have a nice day
Stab resistant vests are lighter than bullet resistant ones.