Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#1

Post by pedro84 » Wed, Jul 26, 2017, 7:51 PM UTC

Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets
blog.exodusintel.com

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#2

Post by shock » Wed, Jul 26, 2017, 8:14 PM UTC

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#3

Post by pedro84 » Wed, Jul 26, 2017, 8:22 PM UTC

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

Apple released fixes for both macOS and iOS last week:

https://support.apple.com/en-us/HT207923 https://support.apple.com/en-us/HT207922

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#4

Post by excalibur » Wed, Jul 26, 2017, 8:23 PM UTC

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

Don't use any devices with a Broadcom Wi-Fi chipset.

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#5

Post by spudlyo » Wed, Jul 26, 2017, 8:25 PM UTC

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

If you have an iPhone make sure you're on iOS 10.3.3. For Macs, you want macOS 10.12.6.

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#6

Post by ben1040 » Wed, Jul 26, 2017, 8:33 PM UTC

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

If your Android OEM has pushed the July 2017 security update to your device, you're patched.

https://source.android.com/security/bulletin/2017-07-01#broa...

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#7

Post by yodon » Wed, Jul 26, 2017, 8:38 PM UTC

ben1040 wrote: post #6

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

If your Android OEM has pushed the July 2017 security update to your device, you're patched. https://source.android.com/security/bulletin/2017-07-01#broa...

Out of curiosity, what fraction of Android OEMs push these security updates promptly (or equivalently what fraction of Android phones receive these kind of updates regularly)?

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#8

Post by merb » Wed, Jul 26, 2017, 8:58 PM UTC

excalibur wrote: post #4

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

Don't use any devices with a Broadcom Wi-Fi chipset.

which basically means don't use any wifi. I think at least 60% of all wi-fi chipsets are broadcom ones.

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#9

Post by [deleted] » Wed, Jul 26, 2017, 9:18 PM UTC

shock wrote: post #2

This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?

[deleted]

Re: Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

#10

Post by ben1040 » Wed, Jul 26, 2017, 9:18 PM UTC

yodon wrote: post #7

ben1040 wrote: post #6

Earlier quoted context omitted.

If your Android OEM has pushed the July 2017 security update to your device, you're patched. https://source.android.com/security/bulletin/2017-07-01#broa...

Out of curiosity, what fraction of Android OEMs push these security updates promptly (or equivalently what fraction of Android phones receive these kind of updates regularly)?

This page has a table of OEMs/devices that, as of the end of May, were fewer than 60 days behind on patches.

https://android-developers.googleblog.com/2017/06/2017-andro...

To me, the takeaway from this is that unless you are using a "flagship" device, or one sold directly by Google, you're probably not getting updates in a timely manner.