Android devices can be fatally hacked by malicious Wi-Fi networks

This is an exploit within the wifi driver? So on iOs this would be a kext, and Apple controls all of that, so they can update and resign the kext and issue it in an update.

Whereas Google can't do that; it'd be up to the handset manufacturer.

Is this an example of the problem Google faces using the Linux kernel in Android? It cedes the kernel to the manufacturer, and wifi (and bluetooth etc) drivers are all kernel space, not user space. So Google can't really do anything here can they?

izacus• 9 years ago

They can and they did - they pushed the update to Nexus and Pixel devices.

emodendroket3• 9 years ago

I know this is a well-rehearsed complaint at this point but having OEMs customizing Android to the point where it can't be updated was a real mistake.

cmurf3• 9 years ago

What I wrote: "Whereas Google can't do that; it'd be up to the handset manufacturer."

Your first statement isn't congruent with your second statement. That they push it to their devices alone does not mean they "can and did" apply the update to all Android devices. My whole post is that they can't push kernel drivers to handsets that aren't theirs.

stevenhubertron• 9 years ago

They can and they did - they pushed the update to Nexus and Pixel devices.

fwiw: my Nexus does not see the update yet.

duskwuff• 9 years ago

This is an exploit within the wifi driver?

No. This exploit runs against the firmware of the wireless chipset itself. (That's what's so weird and interesting about it.)

That being said -- the wireless chipset firmware is loaded by the application processor, so it still requires an OS update to fix.

cmurf3• 9 years ago

OK I'm not familiar with this form of firmware loading. What I see on Linux laptops with proprietary firmware blobs being needed by Broadcom wifi hardware, that firmware lives in /usr/lib/firmware/ and it's up to the kernel driver to load the most recent firmware.

I guess this must work differently on Android handsets with Broadcom wifi, if it's not possible to just push a new firmware bin file into /usr/lib/firmware? Presumably Google could do that, although I'm not sure what the code signing requirments are for firmware blobs such as this.

mintplant• 9 years ago

What's murky to me is how to tell whether I'm affected. I have a BLU R1 HD from Amazon which GSM Arena reports [0] has a Mediatek MT6735 SoC. Does that mean I'm in the clear? I don't see any mention of Broadcom components, but I guess there could be one packaged into something on the list.

[0] http://m.gsmarena.com/blu_r1_hd-8171.php

ReverseCold2• 9 years ago

This is why you either buy an iPhone, Pixel/Nexus, or learn how to port the patches from Pixel/Nexus to your own device.

You could also trust someone on XDA, but that involves trusting a random person.

Android security is abysmal.

StavrosK4• 9 years ago

Android security is abysmal.

Android security isn't abysmal. Third-party (non-Google) Android phones' security might be abysmal, but we should compare it to third party iPhones' security.

bostand3• 9 years ago

Please, software is not perfect, you find bugs you fix them.

And for the record, macbooks had a very similar issue with intel wifi drivers not that many years ago.

logicallee• 9 years ago

Overall I like our title (currently "Android devices can be fatally hacked by malicious Wi-Fi networks") but "fatal" has a specific meaning (causing death) so isn't there some other word in place of that one that could be used here? It is certainly evocative of how dire this is but I feel like a different word might be more specific without losing gravity.

dullgiulio• 9 years ago

Honest question: Why is RADIUS not more widely used? Is it because of limited AP hardware resources?

brazzledazzle2• 9 years ago

It's not uncommon in enterprise networks but it's a PITA to setup and use at home (for most people).

user59944612• 9 years ago

It's the standard for (big enough) enterprises.

The low cost access points don't support it. It's standard on (more expensive) enterprise hardware.

peterwwillis• 9 years ago

It's just overkill. Most users do not need to authenticate to multiple locations, be authorized for discrete network access, and then have their usage of said networks accounted for. Most users just need a shared secret to get on the internet. (And yes, RADIUS and its related backend components do take up more resources)

exabrial• 9 years ago

We really need a release of Android that allows driver updates via manufacturer packages and the app store. This is terrible.

djsumdog• 9 years ago

It's not going to happen. Google makes a ton of money off the fact that people dispose cell phones ever two years, so they're never going to patch their insane OS model. I write about it a bit here:

http://penguindreams.org/blog/android-fragmentation/

..but the gist is that ARM isn't a PC. There's no platform. You've got random pins connected to random shit and only a subset of devices that use Device Tree. Even the ones that do still tend to have a ton of binary blobs and weird kernel patches that can't be up-streamed.

In a way, Windows/x86 makes a lot more sense. You have a base operating system. Any time you buy a new machine, you can wipe it, install the drivers and you've got a nice bloat free OS (until Win10 Advert edition anyway).

You can't just run AOSP. There have been cases where AOSP releases on master have failed to compile or require binary blobs. Maybe this weird Fuchsia crap Google is working on will provide a standard/stabilized kernel an ABI, but I wouldn't count on it.

At least Microsoft phones required UEFI, but they have locked bootloaders. If we wanted decent 3rd party fully open operating systems, I'd say the old Nokia devices would be the way to go if the bootloaders could be cracked.

saurik• 9 years ago

Google makes a ton of money off the fact that people dispose cell phones ever two years...

Huh? I am pretty sure Google subsidizes their Nexus phones (not that they actually sell many) and I thought they didn't charge volume fees for their licensing program... they pretty much run Android to make sure that Apple doesn't take control of all mobile by having a unified API (which for everyone else had to be cobbled together from a diverse and often competing set of manufacturers: no small task) and then use that power to lock Google out of the thing which actually makes them money, which is advertising revenue from tracking capabilities. Other than "it is great for our software if phones were faster", I can't imagine Google would care, financially, if everyone were using older Android hardware and never sold a new device again as long as they could update their software; do you have any financial mechanism for your assertion? When I have last bothered to really pull apart all of the statements, essentially all of the actual profit in the world of Android goes to Samsung.

djrogers• 9 years ago

Google makes a ton of money off the fact that people dispose cell phones ever two years

I've never seen any indication the google makes a PENNY off of someone disposing of their cell phones.

dlubarov2• 9 years ago

There have been cases where AOSP releases on master have failed to compile or require binary blobs.

I wouldn't expect master to be stable, for Android or any other project. If you were setting up a new Linux machine and compiling the kernel yourself, surely you wouldn't build master? AOSP has release branches and RCs like android-7.1.1_r38 which will have gone though a bunch of QA.

Most users wouldn't like stock AOSP though, since the built-in apps are very primitive.

(I'm at Google, but don't work on Android.)

Klathmon2• 9 years ago

I'm not so sure that will actually help all that much.

Qualcomm needs to provide drivers for many of these devices, and if they don't want to do update them the OS can't be updated.

G3E9• 9 years ago

What's the possibility of using this exploit to patch the vulnerable Android systems?.. or to root the phone? It'd be an interesting solution against the time we'll have to wait for carrier services/manufactures to straighten themselves up.

(Say, if, oh I don't know... Knox and My Verizon got disabled or removed, Verizon would have no proof to void my warranty. It was Starbucks' wifi, promise!)

SomeStupidPoint• 9 years ago

I always thought the idea of "coral malware" (made it up, cause it grows and hardens as it goes) was interesting.

Essentially a worm, but one that patches the exploit it uses to infect, and then after X shares, deletes itself except for the patch. Eventually a "reef" of hardened remains covers the platform.

Illegal, because it is still malware, but an interesting avenue that hacktivists could explore.

BoorishBears• 9 years ago

It's happened before:

https://en.wikipedia.org/wiki/Welchia

https://en.wikipedia.org/wiki/Anti-worm

franciscop• 9 years ago

I thought the same about IoT, but of course after some searching it's already been made. All of those "IoT compromised" things you read, the compromising party also changes the default password so they are the only ones.

userbinator• 9 years ago

That thought occurred to me too --- root the phone, patch the exploit, tell the user they now have full control, and don't do anything else malicious.

It's somewhat amusing to consider that giving the user full control of the device he/she owns may be regarded by some as malicious...

Klathmon2• 9 years ago

It's not quite as simple as "giving the user full control".

Doing so requires you to disable many checks and safeguards against other more prevalent kinds of attacks. Having an unlocked bootloader, unsigned OS, modified system partition, and putting all of the power of root behind one closed source binary...

TACIXAT• 9 years ago

The risk is if your payload is not perfect in all cases. Taken to the extreme, you brick a mission critical device and cost a life. This is why malware researchers don't write clean up code once they do C2 takeovers. If their cleanup command wrecks a medical device or some other ancient box still running XP, that's a lot of liability.

Gaelan• 9 years ago

If nothing else, you'd stop them from playing Pokémon Go.

huxley2• 9 years ago

I know many wouldn't see it as malicious (especially if it was done to someone else's device), but doing it without someone's knowledge or consent does seem to cross into that territory, especially if the user didn't understand or value the benefits.

MBlume• 9 years ago

I'm unclear -- does the victim have to actively connect to a malicious network, or does work even if the victim is unconnected/connected to another network?

msgilligan• 9 years ago

By using the frames to target timers responsible for carrying out regularly occurring events such as performing scans for adjacent networks, Beniamini managed to overwrite specific regions of device memory with arbitrary shellcode.

This implies that the exploit can happen when the phone is just scanning for list of available networks.

Neeek• 9 years ago

Two of the vulnerabilities can be triggered when connecting to networks supporting wireless roaming features; 802.11r Fast BSS Transition (FT), or Cisco’s CCKM roaming.

From reading the actual Project Zero post yesterday, the exploit was figured out using the fast BSS transition which I think is for high frequency p2p transmission, i.e. sending a video to your Chromecast. So you still have to be connected to the same network.

https://googleprojectzero.blogspot.com.au/2017/04/over-air-e...

ams6110• 9 years ago

FTA: The Broadcom chipset contains an MPU, but the researcher found that it's implemented in a way that effectively makes all memory readable, writeable, and executable. "This saves us some hassle," he wrote. "We can conveniently execute our code directly from the heap."

How in this decade, with all we know and have learned about security and exploits, can this kind of thing still happen?

bsder2• 9 years ago

How much money will this cost Broadcom? Exactly zero.

So, why should Broadcom care?

sushisource• 9 years ago

Well, I wouldn't say that's true. They could be open to litigation, cost of loss-of-good-faith and therefore losses against competitors.

Not all costs are direct.

RachelF• 9 years ago

In fact, they may make money off it, if the only mitigation is to buy a new phone.

RandomOpinion• 9 years ago

How in this decade, with all we know and have learned about security and exploits, can this kind of thing still happen?

The software industry has learned a lot about a security and exploits, certainly.

The hardware industry, including embedded developers, well, not so much...

goodplay3• 9 years ago

Especially when hardware makers make money off it. I'll need to replace my phone soon, and I'll make an effort to buy something that doesn't use broadcom.

bitmapbrother2• 9 years ago

Remember Stagefright? What ever happened to that? The bloggers promised us all an impending Android security armageddon (and you didn't even have to be on the same WiFi network as this one requires). According to Google's SafetyNet, that gathers telemetry from over 1.5 billion devices, not 1 occurrence of Stagefright has ever been seen in the wild. Think about that for a second.

It turns out developing an exploit, chaining it with other exploits to get around the Android security mitigations and then trying to make it work on devices running different OEM builds of Android was more difficult then people originally thought.

Moral of the story? Next time you hear horror stories about how susceptible your device is to an exploit just remember Stagefright and what a dud that turned out to be.

nikanj2• 9 years ago

Stagefright could be filtered out at operator/app level, unlike this.

bitmapbrother2• 9 years ago

Not really. Unless the carrier prevented the sending of MMS messages there wasn't anything they could do. About the only change made to most apps was to set the MMS auto play setting to off. Stagefright never amounted to anything due in most part to the Android security mitigations and the differences in each version of Android built by the OEM.

jaimex2• 9 years ago

Bachelor of Arts - Security Theatre should be a genuine coarse universitys make available.

Pica_soO2• 9 years ago

So, this is basically a additional protection layer of the android ecosystem? Security by diversity ?

loph• 9 years ago

no headline bias there. ios devices were vulnerable until patched, very recently. the patches are built for android and it's up to the device manufacturers to get them into the wild.

Android devices can be fatally hacked by malicious Wi-Fi networks

Related Stories