Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

blog.coffinsec.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#31

Post by mmsc »

armada651 wrote: post #29
mmsc wrote: post #22

Can the OP's link be changed to the original source, not the advertisement it currently links to? The exploit is documented https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-20...

I don't think that link is necessarily better just because it's the original source. The linked article gives a concise overview, while the blog post spends the first paragraph talking about moving and starting a new job.

In general, I would wager that HN prefers intellectual curiosity over overviews. Submission guidelines infer that by stating "Please submit the original source. If a post reports on something found on another site, submit the latter."

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#32

Post by dvh »

userbinator wrote: post #12
hunter-gatherer wrote: post #4

Original blog: https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-20...

The wappd service is primarily used to configure and coordinate the operations of wireless interfaces and access points using Hotspot 2.0 and related technologies. The structure of the application is a bit complex but it’s essentially composed of this network service, a set of local services which interact with the wireless interfaces on the device, and communication channels between the various components, using Uni…

> The structure of the application is a bit complex

I've done some Android development so let me translate that for you: "layers upon layers of dog shit APIs"

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#33

Post by phh »

xtanx wrote: post #23

I would like to remind people of the 2016 Adups backdoor: > According to Kryptowire, Adups engineers would have been able to collect data such as SMS messages, call logs, contact lists, geo-location data, IMSI and IMEI identifiers, and would have been able to forcibly install other apps or execute root commands on all devices. https://www.bleepingcomputer.com/news/security/android-adups...

How is this relevant?

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#34

Post by zokier »

RedShift1 wrote: post #21

I've been buying laptops with AMD CPU's but they always come with these trash MediaTek RZ616 Wi-Fi cards, why is that? I've been replacing them with Intel Wi-Fi cards, now I have a pile of RZ616 cards ready to become future microplastics :-(

iwlwifi has its own set of problems, biggest being no AP mode (on 5 Ghz). Also intels firmware license is more restrictive than mediateks, and being fullmac the firmware does lot more of the heavy lifting; I personally prefer softmac more. There simply aren't that many great options out there, gone are the golden days of ath9k.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#35

Post by Rinzler89 »

dylan604 wrote: post #17
Namidairo wrote: post #5

Not too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintain…

Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?

>Why can't they hire someone that actually knows what they are doing?

Because those employees cost a lot of money and these commodity widgets have razor thin margins that don't enable them to pay high salaries while also making enough profit to stay in business.

You can pay more to hire better people and put the extra cost in the price of the product but then HP, Lenovo, Dell, et-al aren't gonna buy your product anymore, they're gonna buy instead from your competition who's maybe worse but provides lower prices which is what's most important for them because the average end user of the laptop won't notice the difference between network cards but they do check the sticker price of the machine on Amazon/Walmart and make the purchasing decision on that and stuff like the CPU and GPU not on the network card in the spec sheet.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#36

Post by tetris11 »

usr1106 wrote: post #18

IIRC my phone uses a MediaTek chipset. And I vaguely remember the vendor has moved away from MediaTek since because of the ahem quality of those products... No idea how WiFi is done on a phone though. Is there a way to find out whether the phone is affected? I hardly ever use WiFi because I have unlimited cellular data and good coverage, but would still be good to know.

termux -> "sudo su" and then

    ls /sys/module
(it gives an output similar to lsmod)

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#37

Post by JonChesterfield »

jdietrich wrote: post #30
dylan604 wrote: post #17

Earlier quoted context omitted.

Why is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?

The consumer space is brutally competitive - you're working on tight margins and designs become obsolete very quickly. MediaTek's business is built on selling chips with the latest features at the lowest possible price. Everything has to be done at a breakneck pace that is dictated by the silicon. You start writing firmware as soon as the hardware design is finalised; it needs to be ready as soon as the chips are rea…

Intel networking used to have the expensive and works traits. Not confident their current products would be as good.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#38

Post by qhwudbebd »

The wording of the headline is a bit misleading here. I followed the link thinking it might be a firmware or silicon bug as I have a couple of routers at home with mt76 wifi, but was relieved to find it's just a bug in the vendor's 'sdk' shovelware. I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#39

Post by codethief »

mmsc wrote: post #31
armada651 wrote: post #29

Earlier quoted context omitted.

I don't think that link is necessarily better just because it's the original source. The linked article gives a concise overview, while the blog post spends the first paragraph talking about moving and starting a new job.

In general, I would wager that HN prefers intellectual curiosity over overviews. Submission guidelines infer that by stating "Please submit the original source. If a post reports on something found on another site, submit the latter."

Sure, though I'd argue in the case of vulnerabilities an overview is particularly valuable. Not everyone wants to dive into the details; in my case what I'm most interested in is whether I (or anyone else at my day job) might be affected.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#40

Post by userbinator »

dvh wrote: post #32
userbinator wrote: post #12

Earlier quoted context omitted.

The wappd service is primarily used to configure and coordinate the operations of wireless interfaces and access points using Hotspot 2.0 and related technologies. The structure of the application is a bit complex but it’s essentially composed of this network service, a set of local services which interact with the wireless interfaces on the device, and communication channels between the various components, using Uni…

> The structure of the application is a bit complex I've done some Android development so let me translate that for you: "layers upon layers of dog shit APIs"

I've done some Android RE and agree with you. It's basically Enterprise Java culture.
Post reply on HN