[flagged]
Not an issue with ath9k. Guess why. Hint: not Rust related.
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
81–90 of 109 posts
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#82i still cannot fathom why in this day and age where people buy any silicon that's available, these C tier vendors don't adopt the PC strategy and completely open their firmwares for open source community.
FCC regulations around not making it easy to transmit outside of the licensed band tend to cause this.
ath9k.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#83The wording of the headline is a bit misleading here. I followed the link thinking it might be a firmware or silicon bug as I have a couple of routers at home with mt76 wifi, but was relieved to find it's just a bug in the vendor's 'sdk' shovelware. I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.
> I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd. Not sure if you noticed but the OpenWRT 21.02.x series (based on mainline kernel 5.4 series) is affected, and these guys generally know their game when it comes to wireless on Linux. So much so that I think the mainline kernel mt76 driver is actually maintained by an OpenWRT developer.
Upstream OpenWrt does not use `wappd` so it should not be affected.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#84That's why we need free firmware. I'm tired of Broadcom and Ralink.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#85[flagged]
My anecdotal experience with mediatek wifi is it's a very flakey, low quality brand. That might be more of the reason. The firmware is probably unpolished, rushed, not maintained by competent people.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#86Earlier quoted context omitted.
Back in the day, shell coders would receive the "Useless Use Of Cat" award. https://news.ycombinator.com/item?id=23341711 Today it's giving way to "useless use of su" where admins aren't aware of sudo(8) options like "-s" or "-i"
So with termux there is an actual root password set, but it differs from the phone password so it's often forgotten. The termux developers, knowing this, set it such that the default termix user can invoke sudo without a password. It might seem lazy, but its very useful
I am not sure how passwords are relevant to the pointless chaining of two distinct commands, rather than invoking a straightforward "sudo -s".
People writing "sudo su" are simply imitating a common StackExchange idiom without knowing why.
"su" requires passwords unless invoked by root. "sudo" may be configured to permit/deny specific commands. So if you write that, then you're saying 'become root via the sudoers(5) config and then fork, exec, become root again via the setuid binary "su", in order to run an interactive shell.'
It's a poor habit to be promoting, because it assumes things about the configuration and suggests that "su" is equal to other particular "sudo" maintenance commands, when the point is simply to drop into a root shell, which is a facility provided directly by "sudo", if you'd only read the manual page and learn its options.
Nothing will stop you from invoking "sudo -s" without a password, without another fork/exec, without another suid utility carrying a significantly different authentication model.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#87Earlier quoted context omitted.
Intel networking used to have the expensive and works traits. Not confident their current products would be as good.
When? The Intel X710 series of network cards was released in 2014, and it wasn't until ~2018 that it became actually usable (end of 2018? I don't recall really, but when I stumbled upon it it had already been a public problem for more than a year, and it took a few more months for patches to come). I'm talking things like full OS crashes while doing absolutely nothing, no traffic whatsoever or even better, silently s…
Back at the start of the century, Intel networking cards were the 'Best reliability for the dollar' and for some reason had a grudge against Linksys even before the Cisco buyout [0]. Same for most of their B/G Wireless stuff.
[0] - That came up once.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#88Earlier quoted context omitted.
So with termux there is an actual root password set, but it differs from the phone password so it's often forgotten. The termux developers, knowing this, set it such that the default termix user can invoke sudo without a password. It might seem lazy, but its very useful
I am not sure how passwords are relevant to the pointless chaining of two distinct commands, rather than invoking a straightforward "sudo -s". People writing "sudo su" are simply imitating a common StackExchange idiom without knowing why. "su" requires passwords unless invoked by root. "sudo" may be configured to permit/deny specific commands. So if you write that, then you're saying 'become root via the sudoers(5) c…
Doesn't "sudo -s" keep the current user's environment variables as opposed to "sudo su"?
I admit that in the context of doing "ls /sys/module" it's likely not a huge problem, but I do (in my gut) feel that for running an elevated command, it's cleaner to just drop in as actual root, instead of masquerading as root.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#89Earlier quoted context omitted.
I am not sure how passwords are relevant to the pointless chaining of two distinct commands, rather than invoking a straightforward "sudo -s". People writing "sudo su" are simply imitating a common StackExchange idiom without knowing why. "su" requires passwords unless invoked by root. "sudo" may be configured to permit/deny specific commands. So if you write that, then you're saying 'become root via the sudoers(5) c…
Doesn't "sudo -s" keep the current user's environment variables as opposed to "sudo su"? I admit that in the context of doing "ls /sys/module" it's likely not a huge problem, but I do (in my gut) feel that for running an elevated command, it's cleaner to just drop in as actual root, instead of masquerading as root.
> if you'd only read the manual page and learn its options.
Re: Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
#90I've been buying laptops with AMD CPU's but they always come with these trash MediaTek RZ616 Wi-Fi cards, why is that? I've been replacing them with Intel Wi-Fi cards, now I have a pile of RZ616 cards ready to become future microplastics :-(
Have you tried them further than "I don't trust MediaTek"? I've had sequentially an Intel and an AMD ThinkPad for work (I killed the first one). Turns out, the wifi is much much better on the AMD one with the MediaTek chipset than on the Intel one with the Intel chipset. On the latter, I had very frequent disconnects from the network (severals per hour) along with atrocious latency even on 5GHz. And by atrocious late…
The laptops run Windows. It's not about trust, they just don't work well. They take a long time to connect, particularly after returning from sleep. Many times I have to disconnect and reconnect manually after returning from sleep. I replace them with Intel Wi-Fi ones and it just works. I'd really rather just replace them than face user complaints.