The iPhone 4 and a slew of older devices from Apple, Samsung, HTC, and other manufacturers are vulnerable to attacks that can make it impossible to send or receive data over Wi-Fi networks, a security researcher said.
Proof-of-concept code published online makes it trivial for a moderately skilled hacker to disable older iPhones, HTC Droid Incredible 2s, Motorola Droid X2s, and at least two-dozen other devices, including Edge model cars manufactured by Ford. The Denial-of-Service vulnerability stems from an input-validation error in the firmware of two wireless chips sold by Broadcom: the BCM4325 and the BCM4329. The US Computer Emergency Readiness Team has also issued an advisory warning of the vulnerability.
"The only requirement to exploit the vulnerability is to have a wireless card that supports [the] raw inject of 802.11 frames," Andrés Blanco one of the researchers from Core Security who discovered the vulnerability, told Ars. "The Backtrack Linux distribution has almost everything you need to execute the POC provided in the advisory."
The Core Security advisory said that Broadcom has released a firmware update that patches the "out-of-bounds read error condition" in the chips' firmware. Device manufacturers are making it available to end users on a case-by-case basis since many of the affected products are older and already out of service.
Blanco said the exploit makes it impossible for an affected device to send or receive data over Wi-Fi for as long as the DoS attack lasts. Once the malicious packets subside, the device will work normally. Other device functions are unaffected by the Wi-Fi service interruption. He said it's possible the bug could be exploited to do more serious things.
"We are not sure that we could retrieve private user data but we are going to look into this," he said.
Brief updated to add detail about about device functions in second-to-last paragraph.
reader comments
25