7 ms·

Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi

142 points by skeetmtp 8y ago

PappaPatat 8y ago
TL;DR Reseacher finds super cool RCE over (unconnected) WiFi for the Marvell Avastar Wi-Fi chipset family firmware and one to (locally) exploit the AP device driver. List of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices. Nicely written paper from Embedi researcher Denis Selianin himself: https://embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/ https://embedi.org/blog/remotely-compromise-devices-by-using...
- sctb 8y ago
  Thanks! We've updated the link from https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/ https://www.zdnet.com/article/wifi-firmware-bug-affects-lapt....
devereaux 8y ago
Given that Wifi chips already have their own ARM CPU, at this point I'd rather have that CPU which already runs its own OS to just present as a network device to do NAT. Connect it to the fixed network, use a serial link - anything will do. At least, I'd rather have anything but the current alternative: a device on the PCI bus having DMA with a firmware I can't audit. Same thing with WWAN device by the way.
- minipci1321 8y ago
  Not speaking specifically of the OP case, but CPU gets less and less involved in the datapath starting from a certain requirement of the max throughput. Insisting on it's going through the CPU still would raise the bar on the CPU (as a consequence, more fast RAM and increased overall power consumption, shorter battery life). > with a firmware I can't audit. In modern fast datapaths, there is a good deal of hardware acceleration involved, the firmware code would probably be incomprehensible without intimately knowing these.
  - devereaux 8y ago
    Yes, there would be a IO load. Tradeoffs, as always. For some applications, I want low latency and high throughput. For others, I want security.
- the8472 8y ago
  My understanding is that all modern OSes now use the IOMMU to protect system memory from rogue devices. Of course that protection is only as good as the PCIe implementation and the drivers doing the mapping and operating on the mapped structures.
ComodoHacker 8y ago
> Patches are in the works. Does than mean the procedure of responsible disclosure was followed but vendor failed to patch on time?
mehrdadn 8y ago
I'm confused.. so Wi-Fi chips run OSes inside them now?
- enkid 8y ago
  Yes, normally some sort of real time OS.
- hawski 8y ago
  Remember that your computer is really made of multiple computers that run bare-metal code or can have their own OSes. For example Intel CPUs have Minix running inside of them.
  - mehrdadn 8y ago
    Some of these I knew (hard drive, LTE modem, etc.), but I didn't realize Wi-Fi was such an example.
    - marcosdumay 8y ago
      Wi-fi adapters are some of the most processing-heavy peripherals people have. After the memory controller, bus bridges, GPUs, and DMA controller, it's probably the largest one.
      - mehrdadn 8y ago
        Does processing-heavy imply it has an RTOS in it? (Do all the things you mentioned have RTOSes in them?)
        marcosdumay 8y ago
        It means it has a large processor that can run an RTOS. It does not automatically mean it has an RTOS. I would be surprised if the faster bus and memory controllers had it (because of latency problems). I would expect something like it on a USB controller, GPU, network or disk interface. I really have no idea what to expect from a DMA controller.
jake_the_third 8y ago
Good. I hope that vulnerabilities like this continue to surface until legislators take notice. Morally bankrupt vendors will never stop locking down hardware unless governments get involved. Fuck each and every company that does this. Fuck them all to hell.
- mschuster91 8y ago
  While I agree with you that vendors need to be held accountable for shipping crap, we also have to beware that we don't end up in a world of devices we cannot do anything on. All kinds of jailbreaks, no matter if for the first generations of iPhones, for consoles, or for rooting Android devices, are based on vendors implementing shoddy security. Take it away and whoops, now we as users are fully in the death grip of what vendors and RIAA/MAFIAA allow us to do.
  - userbinator 8y ago
    we also have to beware that we don't end up in a world of devices we cannot do anything on. IMHO it's already gotten a bit too far in that direction, and if there's no mass revolt (which is itself quite unlikely), it's only going to get worse. The old Franklin quote has never been so relevant... people these days are so highly valuing "safe" over "free", that they don't realise they're building prisons around themselves.
  - sedachv 8y ago
    An actionable way to discourage this outcome is to use the General Public License version 3 or later, which contains "right to repair/right to tinker" provisions: https://www.gnu.org/licenses/quick-guide-gplv3.en.html https://www.gnu.org/licenses/quick-guide-gplv3.en.html In the United States, you can also join The Repair Association advocacy group: https://repair.org/ https://repair.org/
  - jake_the_third 8y ago
    We're actually on the same page here. I should have worded my comment more clearly: Governments should get involved and force vendors to allow device owners full control over their devices. Not only to secure them selves from vendor mistakes, but also to repurpose the device to fit their needs.
cataflam 8y ago
WiFi chips and baseband processors are particularly attractive targets for exploitation, since they are network entry point for devices, and running systems that have probably been less investigated (at least publicly). Very nice research and writeup. For those who haven't seen it a couple of years ago, Project Zero also had a series of articles about exploiting Broadcom's WiFi stack [0]. [0] https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl...
acd 8y ago
Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device? For security purposes we do not want any binary drivers, blobs, bloated boat loaders and other fancy non-security in the hardware. This is really really basic security level.
- zamadatix 8y ago
  802.11-2016 is a 3000+ page (very dense) technical standard, you'd need bigger backing than a crowdfunding campaign to create an open hardware+open software solution for it.
- nerdbaggy 8y ago
  It’s hard. Cisco doesn’t even make their own WiFi chips. The cost to benefit ratio isn’t worth it.
- mrsteveman1 8y ago
  > Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device? A few RF transceivers and an FPGA like an Artix-7 (which has PCIe capability) might do the trick. It wouldn't be as cheap as a mass produced chipset, but a completely open 802.11ac chipset is unlikely to be mass produced anyway. We already have examples of LTE base stations being run with SDR hardware like the LimeSDR, which is just an RF transceiver and an Altera FPGA, with a USB3 connection to the FPGA fabric. In fact there are some SDR/FPGA dev kits that are Mini PCIe size and intended for use inside a laptop, specifically designed with LTE in mind[1]. So WiFi seems doable, even if you end up with a soft core CPU in the FPGA to do the same jobs WiFi chipset firmware is doing right now, at least you'd have full control over it and the firmware running on it. [1] https://www.crowdsupply.com/fairwaves/xtrx https://www.crowdsupply.com/fairwaves/xtrx
  - throwaway2048 8y ago
    unfortunately the FPGA ecosystem is even more closed and open source unfriendly than the wifi hardware one, you aren't allowed to know anything about the chips, how code runs, or how to upload your own code, and you even have to use vendor specific IDEs and language extensions you are lucky if work anywhere outside of windows. Current market FPGAs definitely aren't some shining beacon alternative to shitty hardware vendors, they are amongst the worst of the lot.
Hacker_Support 8y ago
Hiring a hacker these days is a bit difficult because lots of people fall for scams. Does that mean there aren't real hackers online? NO definitely!! Make foundings about us. You can check us up at hackerone(dot)com Check our profile on Google to see what we've been up to, where we've worked and what we specialised in. Ask us questions. I prove myself beyond reasonable doubts on all Hacking jobs. Be sure you are making the right decision. Don't just make payment without knowing what approach specifically. You need a professional hacker? Send a mail to the Email on my bio hacktech@hackermail.com Be safe out there!!!

142 points by skeetmtp 8y ago

TL;DR Reseacher finds super cool RCE over (unconnected) WiFi for the Marvell Avastar Wi-Fi chipset family firmware and one to (locally) exploit the AP device driver. List of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices. Nicely written paper from Embedi researcher Denis Selianin himself: https://embedi.org/blog/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce/ https://embedi.org/blog/remotely-compromise-devices-by-using...

sctb 8y ago
Thanks! We've updated the link from https://www.zdnet.com/article/wifi-firmware-bug-affects-laptops-smartphones-routers-gaming-devices/ https://www.zdnet.com/article/wifi-firmware-bug-affects-lapt....

devereaux 8y ago

Given that Wifi chips already have their own ARM CPU, at this point I'd rather have that CPU which already runs its own OS to just present as a network device to do NAT. Connect it to the fixed network, use a serial link - anything will do. At least, I'd rather have anything but the current alternative: a device on the PCI bus having DMA with a firmware I can't audit. Same thing with WWAN device by the way.

minipci1321 8y ago
Not speaking specifically of the OP case, but CPU gets less and less involved in the datapath starting from a certain requirement of the max throughput. Insisting on it's going through the CPU still would raise the bar on the CPU (as a consequence, more fast RAM and increased overall power consumption, shorter battery life). > with a firmware I can't audit. In modern fast datapaths, there is a good deal of hardware acceleration involved, the firmware code would probably be incomprehensible without intimately knowing these.
- devereaux 8y ago
  Yes, there would be a IO load. Tradeoffs, as always. For some applications, I want low latency and high throughput. For others, I want security.
the8472 8y ago
My understanding is that all modern OSes now use the IOMMU to protect system memory from rogue devices. Of course that protection is only as good as the PCIe implementation and the drivers doing the mapping and operating on the mapped structures.

ComodoHacker 8y ago

> Patches are in the works. Does than mean the procedure of responsible disclosure was followed but vendor failed to patch on time?

mehrdadn 8y ago

I'm confused.. so Wi-Fi chips run OSes inside them now?

enkid 8y ago
Yes, normally some sort of real time OS.
hawski 8y ago
Remember that your computer is really made of multiple computers that run bare-metal code or can have their own OSes. For example Intel CPUs have Minix running inside of them.
- mehrdadn 8y ago
  Some of these I knew (hard drive, LTE modem, etc.), but I didn't realize Wi-Fi was such an example.
  - marcosdumay 8y ago
    Wi-fi adapters are some of the most processing-heavy peripherals people have. After the memory controller, bus bridges, GPUs, and DMA controller, it's probably the largest one.
    - mehrdadn 8y ago
      Does processing-heavy imply it has an RTOS in it? (Do all the things you mentioned have RTOSes in them?)
      - marcosdumay 8y ago
        It means it has a large processor that can run an RTOS. It does not automatically mean it has an RTOS. I would be surprised if the faster bus and memory controllers had it (because of latency problems). I would expect something like it on a USB controller, GPU, network or disk interface. I really have no idea what to expect from a DMA controller.

jake_the_third 8y ago

Good. I hope that vulnerabilities like this continue to surface until legislators take notice. Morally bankrupt vendors will never stop locking down hardware unless governments get involved. Fuck each and every company that does this. Fuck them all to hell.

mschuster91 8y ago
While I agree with you that vendors need to be held accountable for shipping crap, we also have to beware that we don't end up in a world of devices we cannot do anything on. All kinds of jailbreaks, no matter if for the first generations of iPhones, for consoles, or for rooting Android devices, are based on vendors implementing shoddy security. Take it away and whoops, now we as users are fully in the death grip of what vendors and RIAA/MAFIAA allow us to do.
- userbinator 8y ago
  we also have to beware that we don't end up in a world of devices we cannot do anything on. IMHO it's already gotten a bit too far in that direction, and if there's no mass revolt (which is itself quite unlikely), it's only going to get worse. The old Franklin quote has never been so relevant... people these days are so highly valuing "safe" over "free", that they don't realise they're building prisons around themselves.
- sedachv 8y ago
  An actionable way to discourage this outcome is to use the General Public License version 3 or later, which contains "right to repair/right to tinker" provisions: https://www.gnu.org/licenses/quick-guide-gplv3.en.html https://www.gnu.org/licenses/quick-guide-gplv3.en.html In the United States, you can also join The Repair Association advocacy group: https://repair.org/ https://repair.org/
- jake_the_third 8y ago
  We're actually on the same page here. I should have worded my comment more clearly: Governments should get involved and force vendors to allow device owners full control over their devices. Not only to secure them selves from vendor mistakes, but also to repurpose the device to fit their needs.

cataflam 8y ago

WiFi chips and baseband processors are particularly attractive targets for exploitation, since they are network entry point for devices, and running systems that have probably been less investigated (at least publicly). Very nice research and writeup. For those who haven't seen it a couple of years ago, Project Zero also had a series of articles about exploiting Broadcom's WiFi stack [0]. [0] https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

acd 8y ago

Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device? For security purposes we do not want any binary drivers, blobs, bloated boat loaders and other fancy non-security in the hardware. This is really really basic security level.

zamadatix 8y ago
802.11-2016 is a 3000+ page (very dense) technical standard, you'd need bigger backing than a crowdfunding campaign to create an open hardware+open software solution for it.
nerdbaggy 8y ago
It’s hard. Cisco doesn’t even make their own WiFi chips. The cost to benefit ratio isn’t worth it.
mrsteveman1 8y ago
> Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device? A few RF transceivers and an FPGA like an Artix-7 (which has PCIe capability) might do the trick. It wouldn't be as cheap as a mass produced chipset, but a completely open 802.11ac chipset is unlikely to be mass produced anyway. We already have examples of LTE base stations being run with SDR hardware like the LimeSDR, which is just an RF transceiver and an Altera FPGA, with a USB3 connection to the FPGA fabric. In fact there are some SDR/FPGA dev kits that are Mini PCIe size and intended for use inside a laptop, specifically designed with LTE in mind[1]. So WiFi seems doable, even if you end up with a soft core CPU in the FPGA to do the same jobs WiFi chipset firmware is doing right now, at least you'd have full control over it and the firmware running on it. [1] https://www.crowdsupply.com/fairwaves/xtrx https://www.crowdsupply.com/fairwaves/xtrx
- throwaway2048 8y ago
  unfortunately the FPGA ecosystem is even more closed and open source unfriendly than the wifi hardware one, you aren't allowed to know anything about the chips, how code runs, or how to upload your own code, and you even have to use vendor specific IDEs and language extensions you are lucky if work anywhere outside of windows. Current market FPGAs definitely aren't some shining beacon alternative to shitty hardware vendors, they are amongst the worst of the lot.

Hacker_Support 8y ago

Hiring a hacker these days is a bit difficult because lots of people fall for scams. Does that mean there aren't real hackers online? NO definitely!! Make foundings about us. You can check us up at hackerone(dot)com Check our profile on Google to see what we've been up to, where we've worked and what we specialised in. Ask us questions. I prove myself beyond reasonable doubts on all Hacking jobs. Be sure you are making the right decision. Don't just make payment without knowing what approach specifically. You need a professional hacker? Send a mail to the Email on my bio hacktech@hackermail.com Be safe out there!!!