Live data from Hacker News

Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

blog.coffinsec.com

71–80 of 109 posts

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#71
post #60

> The affected versions include MediaTek SDK versions 7.4.0.1 and earlier, as well as OpenWrt 19.07 and 21.02. > The vulnerability resides in wappd, a network daemon included in the MediaTek MT7622/MT7915 SDK and RTxxxx SoftAP driver bundle. OpenWRT doesn't seem to use wappd though?

Came here wondering this, as I have several Netgear APs running OpenWRT on my home network. Sounds like I'm in the clear?

If it's a clean upstream OpenWRT, yes. For vendored OpenWRT, all bets are off.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#72

Earlier quoted context omitted.

FCC regulations around not making it easy to transmit outside of the licensed band tend to cause this.

that point is completely bogus since hardware oscillators limit the range. and even multi range devices let the driver decide the region, so even with closed source you can already offend fcc regulations (pro tip set your wifi region to cuba for extra channels)

Hardware oscillators don't limit anything, PLL ranges and amplifier band characteristics do, and they have soft falloffs. Please stop making claims you have little knowledge around.

(no, a PLL is not considered a "hardware oscillator" in any practical sense by anyone working in this area, that's "tomatoes in a fruit salad" category)

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#74

The wording of the headline is a bit misleading here. I followed the link thinking it might be a firmware or silicon bug as I have a couple of routers at home with mt76 wifi, but was relieved to find it's just a bug in the vendor's 'sdk' shovelware. I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.

> relieved to find it's just a bug in the vendor's 'sdk' shovelware Vendors plural to worry about: “…driver bundles used in products from various manufacturers, including [but not limited to] Ubiquiti, Xiaomi and Netgear.” That said, vendors (plural) say no products use this, e.g. Ubiquiti: https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d...

Sorry, yes, my use of 'vendor' here was ambiguous. I meant Mediatek, the chipset vendor.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#75
post #66

Earlier quoted context omitted.

Intel networking used to have the expensive and works traits. Not confident their current products would be as good.

When? The Intel X710 series of network cards was released in 2014, and it wasn't until ~2018 that it became actually usable (end of 2018? I don't recall really, but when I stumbled upon it it had already been a public problem for more than a year, and it took a few more months for patches to come). I'm talking things like full OS crashes while doing absolutely nothing, no traffic whatsoever or even better, silently s…

you'd be glad to hear the e810 series is not better in this regard. at least the out-of-tree driver somewhat works, and supports more than 1 queue.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#76
post #18

IIRC my phone uses a MediaTek chipset. And I vaguely remember the vendor has moved away from MediaTek since because of the ahem quality of those products... No idea how WiFi is done on a phone though. Is there a way to find out whether the phone is affected? I hardly ever use WiFi because I have unlimited cellular data and good coverage, but would still be good to know.

termux -> "sudo su" and then ls /sys/module (it gives an output similar to lsmod)

Back in the day, shell coders would receive the "Useless Use Of Cat" award.

https://news.ycombinator.com/item?id=23341711

Today it's giving way to "useless use of su" where admins aren't aware of sudo(8) options like "-s" or "-i"

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#77

The wording of the headline is a bit misleading here. I followed the link thinking it might be a firmware or silicon bug as I have a couple of routers at home with mt76 wifi, but was relieved to find it's just a bug in the vendor's 'sdk' shovelware. I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.

> I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.

Not sure if you noticed but the OpenWRT 21.02.x series (based on mainline kernel 5.4 series) is affected, and these guys generally know their game when it comes to wireless on Linux. So much so that I think the mainline kernel mt76 driver is actually maintained by an OpenWRT developer.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#78

I've been buying laptops with AMD CPU's but they always come with these trash MediaTek RZ616 Wi-Fi cards, why is that? I've been replacing them with Intel Wi-Fi cards, now I have a pile of RZ616 cards ready to become future microplastics :-(

Have you tried them further than "I don't trust MediaTek"?

I've had sequentially an Intel and an AMD ThinkPad for work (I killed the first one). Turns out, the wifi is much much better on the AMD one with the MediaTek chipset than on the Intel one with the Intel chipset. On the latter, I had very frequent disconnects from the network (severals per hour) along with atrocious latency even on 5GHz. And by atrocious latency, I mean atrocious as in "it is more than noticeable when using ssh". The current one has been rock solid for the past two or three years.

So yeah, I guess it really depends. The specific chipset I have is a MT7921 and I'm running Linux, YMMV. And it also may depend on the laptop itself.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#79

Earlier quoted context omitted.

Making the code available doesn’t necessarily mean that you can actually flash the image since it can be cryptographically locked down. Or even you support flashing but only let you do certain trusted operations from a signed image.

you managed to completely miss the point. going the pc route is fully embracing your hardware accept whatever software the user wants. not throw unbuildable source somewhere and make it impossible to use. that's the faux open source we have today when someone must comply with the gpl or something

I think you happened to miss the point about regulatory requirements that make this difficult/impossible to accomplish for the radio vendor. I think the proliferation of SDR is the only hope to change the broader regulatory culture but until that happens you're not going to see a shift.

I think it's also rich calling GPL compliance faux open source. There really is no true Scotsman.

Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability

#80

Earlier quoted context omitted.

termux -> "sudo su" and then ls /sys/module (it gives an output similar to lsmod)

Back in the day, shell coders would receive the "Useless Use Of Cat" award. https://news.ycombinator.com/item?id=23341711 Today it's giving way to "useless use of su" where admins aren't aware of sudo(8) options like "-s" or "-i"

So with termux there is an actual root password set, but it differs from the phone password so it's often forgotten.

The termux developers, knowing this, set it such that the default termix user can invoke sudo without a password.

It might seem lazy, but its very useful

Post reply on HN