Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability • Hacker News Board

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#11

Post by pixl97 » Sat, Sep 21, 2024, 3:06 AM UTC

saagarjha wrote: post #6

shadowpho wrote: post #3

Exploit is hard to distinguish between a back door here.

Posting claims of it being such is pretty easy, though.

There is a better middle ground here by saying the company that made it may not have known, but nation state threat actors most likely do.

When you see actors at this level set up manufacturing thousands of explosive filled devices at very high production quality, inserting some compromised things like printers or routers in a company network wouldn't be and shouldn't be a surprise.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#12

Post by userbinator » Sat, Sep 21, 2024, 3:11 AM UTC

hunter-gatherer wrote: post #4

Original blog: https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-20...

The wappd service is primarily used to configure and coordinate the operations of wireless interfaces and access points using Hotspot 2.0 and related technologies. The structure of the application is a bit complex but it’s essentially composed of this network service, a set of local services which interact with the wireless interfaces on the device, and communication channels between the various components, using Unix domain sockets.

On the bright side, it doesn't sound like this is in baseband firmware but instead in a "value add" service that isn't 100% necessary to the functioning of the WNIC itself.

This reminds me of how some devices come with driver packages that include not just the actual driver software that's usually tiny and unobtrusive, but several orders of magnitude larger bloatware for features that 99% of users don't need nor want. Printers and GPUs are particularly guilty of this.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#13

Post by fn-mote » Sat, Sep 21, 2024, 3:11 AM UTC

vlovich123 wrote: post #9

userbinator wrote: post #8

Earlier quoted context omitted.

FCC regulations around not making it easy to transmit outside of the licensed band tend to cause this.

Making the code available doesn’t necessarily mean that you can actually flash the image since it can be cryptographically locked down. Or even you support flashing but only let you do certain trusted operations from a signed image.

I feel like I'm missing something here.

Honestly, if you can't update the firmware you're in the same situation... knowing that you have a critical vulnerability and unable to fix it.

Enforcing trusted operations is definitely more work than they are going to do (if it's even possible to "do this right").

In a semi-ideal world, I would look for a vendor that permits only certain ops from a flashed image and hope that their crappy "restriction enforcing" code is also riddled with vulnerabilites so it's really just "follow the rules please".

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#14

Post by molticrystal » Sat, Sep 21, 2024, 3:14 AM UTC

Namidairo wrote: post #5

Not too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintain…

Is there any news releases or other information about that program, such as their goals, how much of the feed is merged upstream, etc?

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#15

Post by hedora » Sat, Sep 21, 2024, 4:34 AM UTC

pixl97 wrote: post #11

saagarjha wrote: post #6

Earlier quoted context omitted.

Posting claims of it being such is pretty easy, though.

There is a better middle ground here by saying the company that made it may not have known, but nation state threat actors most likely do. When you see actors at this level set up manufacturing thousands of explosive filled devices at very high production quality, inserting some compromised things like printers or routers in a company network wouldn't be and shouldn't be a surprise.

If the nation state actors did intentionally backdoor it, then they would have wanted to make it look like incompetence. Here’s a link to the Simple Sabotage Field Manual from the US. It worked well in occupied Europe during WWII:

https://archive.org/details/SimpleSabotageFieldManual

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#16

Post by hedora » Sat, Sep 21, 2024, 4:42 AM UTC

kam wrote: post #10

They say that OpenWrt 19.07 and 21.02 are affected, but as far as I can tell, official builds of OpenWrt only use the mt76 driver and not the Mediatek SDK.

It’s similar for Ubiquti:

https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d...

There are vulnerable drivers for some chipsets used by UBNT hardware, but they have zero products that use those drivers.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#17

Post by dylan604 » Sat, Sep 21, 2024, 4:43 AM UTC

Namidairo wrote: post #5

Not too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintain…

Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#18

Post by usr1106 » Sat, Sep 21, 2024, 5:09 AM UTC

IIRC my phone uses a MediaTek chipset. And I vaguely remember the vendor has moved away from MediaTek since because of the ahem quality of those products...

No idea how WiFi is done on a phone though. Is there a way to find out whether the phone is affected? I hardly ever use WiFi because I have unlimited cellular data and good coverage, but would still be good to know.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#19

Post by dboreham » Sat, Sep 21, 2024, 5:24 AM UTC

dylan604 wrote: post #17

Namidairo wrote: post #5

Not too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintain…

Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?

Because money

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#20

Post by ta988 » Sat, Sep 21, 2024, 5:42 AM UTC

dylan604 wrote: post #17

Namidairo wrote: post #5

Not too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintain…

Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?

Because you have to over pay all those executives and shareholders.