Live data from Hacker News

Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

embedi.org

21–30 of 51 posts

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#21

Earlier quoted context omitted.

Embedded micro controllers are very common these days in a wide range of ICs most of them aren’t disclosed or accessible to their users their sole role is to abstract the physical IC and present what the customer expects this can be things like timers, flash memory or even microcontrollers themselves as well as more complex ICs that need to ensure some defined PHY like network or serial controllers.

That's what I expected but it sounds like these are specifically not that?

Which ones? The ones on SD cards are there for one reason only and that is to provide the hardware abstraction and PHY compatibility to allow SD cards to be manufactured more cheaply.

I haven’t seen any evidence that any of these MC does anything beyond that.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#23
post #20
post #5

I'm confused.. so Wi-Fi chips run OSes inside them now?

A RTOS is not really an OS, just a super-fast way of dealing with I/O streams. More driver/firmware than OS, if you ask me. But some companies need fancy words for marketing, I guess.

A RTOS is most definitely a real OS. Look at QNX.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#24
post #20
post #5

I'm confused.. so Wi-Fi chips run OSes inside them now?

A RTOS is not really an OS, just a super-fast way of dealing with I/O streams. More driver/firmware than OS, if you ask me. But some companies need fancy words for marketing, I guess.

> not really an OS, just a super-fast way of dealing with I/O streams

Saying this without any animosity, but you would probably be interested in reading about the history of operating systems. Desktop OSes are a (very visible) minority, and it's the opposite way in my opinion: a desktop OS is an OS + a large suite of tools + a shell.

It's literally something that operates the system so that every program written doesn't have to handle all the low level IO, that enables task management, etc.

https://en.wikipedia.org/wiki/History_of_operating_systems

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#25
post #20
post #5

I'm confused.. so Wi-Fi chips run OSes inside them now?

A RTOS is not really an OS, just a super-fast way of dealing with I/O streams. More driver/firmware than OS, if you ask me. But some companies need fancy words for marketing, I guess.

RTOS literally means "OS with real-time capabilities", you can't say in general that an RTOS is not really an OS. QNX is very clearly an OS. Linux with real-time modifications is clearly an OS. And even with really small variants, like ThreadX in this case, they have many markers of an OS: It provides threads, with scheduling, synchronization and memory isolation (if the hardware supports that). It has a networking stack and file system abstractions. What exactly is it missing that makes it clearly "not an OS"?

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#26
WiFi chips and baseband processors are particularly attractive targets for exploitation, since they are network entry point for devices, and running systems that have probably been less investigated (at least publicly).

Very nice research and writeup. For those who haven't seen it a couple of years ago, Project Zero also had a series of articles about exploiting Broadcom's WiFi stack [0].

[0] https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#28
Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device?

For security purposes we do not want any binary drivers, blobs, bloated boat loaders and other fancy non-security in the hardware. This is really really basic security level.

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#29

TL;DR Reseacher finds super cool RCE over (unconnected) WiFi for the Marvell Avastar Wi-Fi chipset family firmware and one to (locally) exploit the AP device driver. List of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices. Nicely written paper from Embedi researcher Denis Selianin himself: https://embedi.org/blog/remotely-compromise-devices-by-using...

Thanks! We've updated the link from https://www.zdnet.com/article/wifi-firmware-bug-affects-lapt....

Re: Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

#30
post #28

Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device? For security purposes we do not want any binary drivers, blobs, bloated boat loaders and other fancy non-security in the hardware. This is really really basic security level.

802.11-2016 is a 3000+ page (very dense) technical standard, you'd need bigger backing than a crowdfunding campaign to create an open hardware+open software solution for it.
Post reply on HN