Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple: Heap Overflow in AppleBCMWLANCore Driver

bugs.chromium.org

Post reply on HN
Print view View original

41–50 of 72 posts

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#41

Post by floatingatoll »

revelation wrote: post #3
mangix wrote: post #2

Wonder what this means in the grand scheme of things. Will Apple dump Broadcom and go with Qualcomm or attempt to fix Broadcom's broken driver. I say broken as I've yet to see good code come from Broadcom.

This is a bug that was already fixed. It means nothing in the grand scheme. In the current grand scheme, Apple and Qualcomm are also currently suing each other and I'm pretty sure part of that is Apple withholding billions in payments.

This is a Hacker News post about an interesting security vulnerability. It is, by both moderator and owner intentions, specifically meaningful in the 'grand scheme' of Hacker News, a site set up to permit people to discuss links.

Yes, at a different level of business, Apple has an open lawsuit against Qualcomm, but that's not the scope that we're here to discuss. Mentioning it is fine, linking to a recent HN post about it would be stellar!, but "It means nothing in the grand scheme" is dismissive and wrong.

Your concerns are clearly expressed, but insulting others for choosing to discuss a topic not relevant to your concerns is no excuse to shut them down verbally. That approach is not welcome here.

EDIT: I'm not a mod or anything.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#42

Post by flukus »

0x0 wrote: post #13
sigjuice wrote: post #10

Is every buffer overflow important enough to need detailed discussion and commentary?

I think these latest sets of wifi flaws are interesting if it turns out they are exploitable by merely being in radio range of an attacker even without joining a malicious network or requiring user interaction. That could quickly become a fast and wormable attack. You could probably flood across an entire city jumping from chip to chip in no time. Especially now that iOS 11's wifi-off button in the control center no…

Does not having to join a network make a big difference for a worm considering the amount of wifi networks we share with large numbers of other people?

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#43

Post by ronnier »

MBCook wrote: post #23
ronnier wrote: post #15

Earlier quoted context omitted.

> Especially now that iOS 11's wifi-off button in the control center no longer actually disables the radio I still can’t belive this decision. I keep my Bluetooth and Wi-Fi off as much as possible and it’s now difficult to to as a result of this change is ios11. Really bothers me.

I really don’t understand why people keep those two off. If you’re not using them they use very little battery at this point; it’s not like it was 10 years ago. Since Apple keeps detailed usage statistics (from the people who opt in) my guess is they know how common such a behavior is and it’s obviously low enough they don’t think this change is a problem. I agree with some of the other comments I’ve seen that this p…

I keep it off because of exploits posted in this article.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#44

Post by swinglock »

kalleboo wrote: post #39
IBM wrote: post #38

Earlier quoted context omitted.

Turn off "ask to join" and it will only connect to known networks.

The station wifi is known though, so when I have a long wait for a train at a station I'm not burning data on YouTube

You can set the known network not to connect automatically. But you can only access that setting when you are in range.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#45

Post by ComputerGuru »

senatorobama wrote: post #11
0x0 wrote: post #8

Earlier quoted context omitted.

Maybe not this time, but they have a history of fatal firmware bugs that could compromise the host system - such as http://boosterok.com/blog/broadpwn2/

These companies with widely available low level firmware should really switch to Rust.

I love rust and have rewritten a dozen cross-platform utilities in it, but rust is nowhere near usable for general purpose embedded development.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#46

Post by KGIII »

copperx wrote: post #31
Razengan wrote: post #19

Earlier quoted context omitted.

Just go into Settings and disable it as usual.

Or just place it in Airplane Mode and enable Wifi or Bluetooth selectively. At least that's what I do in iOS 10. I hope it's still possible in 11.

Doesn't airplane mode disconnect the cellular radio?

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#47

Post by kalleboo »

swinglock wrote: post #44
kalleboo wrote: post #39

Earlier quoted context omitted.

The station wifi is known though, so when I have a long wait for a train at a station I'm not burning data on YouTube

You can set the known network not to connect automatically. But you can only access that setting when you are in range.

I didn't know about that setting, thanks for the tip. Will definitely come in handy.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#48

Post by kranner »

Razengan wrote: post #18
0x0 wrote: post #14

Earlier quoted context omitted.

Nope, so this is going to be interesting to watch. Personally I was hoping that they would offer an optional download of 32bit support libraries to let iOS11 users run important existing legacy apps and access their documents, but they seem to push hard on making developers get in line and update their apps. Which is unhelpful for the cases where the developers no longer have any interest in their apps or even exist…

If the developer is bankrupt, disbanded or deceased then the app generally can not remain published for longer than a year at most anyway. If the developer does not have any interest in updating their own app, do I as a user care about their apps?

> If the developer does not have any interest in updating their own app, do I as a user care about their apps?

A developer's primary interest in their app is to earn an income. A user's interest is in using the app for whatever functionality it provided. There's no symmetry here.

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#49

Post by ge0rg »

microcolonel wrote: post #9
0x0 wrote: post #8

Earlier quoted context omitted.

Maybe not this time, but they have a history of fatal firmware bugs that could compromise the host system - such as http://boosterok.com/blog/broadpwn2/

For what it's worth, Broadcom's market share in attractive heavy-firmware wifi adapters is pretty high. They could just be an exploit magnet.

Does that mean that all embedded WiFi (and probably also baseband) controllers are deeply rotten, and we only blame Broadcom so far because of their popularity with device manufacturers?

Re: Apple: Heap Overflow in AppleBCMWLANCore Driver

#50

Post by 0x0 »

kevinchen wrote: post #26
0x0 wrote: post #14

Earlier quoted context omitted.

Nope, so this is going to be interesting to watch. Personally I was hoping that they would offer an optional download of 32bit support libraries to let iOS11 users run important existing legacy apps and access their documents, but they seem to push hard on making developers get in line and update their apps. Which is unhelpful for the cases where the developers no longer have any interest in their apps or even exist…

It's not just a matter of the space on disk to hold 32-bit libraries. They must also be loaded into memory if there are 32-bit processes running. This degrades performance system-wide, not just for the abandonware apps.

What good is RAM for if not running the applications a user needs to run? If the user is not currently running a 32bit app, drop the libraries from RAM. That is such a non-argument. The amount of space and time needed to load and unload 32bit support libraries is probably 1% of the space and time used every time a user loads a game, or the facebook app, for example.
Post reply on HN