11 ms·
Beacown (Linux WiFi Exploit)
- fsflover 4y agoCurrent discussion: https://news.ycombinator.com/item?id=33200171 https://news.ycombinator.com/item?id=33200171.
- joosters 4y ago[x] Catchy name [ ] Catchy logo Poor effort, only 50% of the way there. (No marks awarded for a working exploit, marketing doesn't care about that) Edit: Marks should also be deducted for a lack of scary text claiming that everyone should panic.
- Scaevolus 4y agoSome sort of evil bee/cow hybrid with psychic (wifi) waves would work well as a logo, to help generate buzz.
- Manu40 4y agoI was thinking something similar. A cow with x's over the eyes, possibly glowing red; with antennae's instead of horns with wifi waves coming off them.
- gw99 4y agoI think we need a vulnerability buzzword bingo.
- ncmncm 4y agoJust to be clear, everyone really should panic. Right?
- kibwen 4y agoPlenty of Android devices have kernels that are too old to be vulnerable. Versions 5.1 and newer are vulnerable.
- sgt 4y agoWhich versions of Android would that translate to?
- llarsson 4y agoIt seems to me that Android version and kernel version are not linked in any meaningful way. My phone is Android 12 and the kernel is 4.19.x, which initially came out in 2018 (but is an LTS one, so it's fine).
- ncmncm 4y agoOlder kernels are instead vulnerable to older bugs, since fixed, of not less severity, but more systematically exploited.
- Wowfunhappy 4y agoDo you have any particular exploits in mind? The idea that you could gain RCE without the user doing anything except being in range of a wifi hotspot—no need to run an app, load a website, or even open an image—strikes me as exceptionally concerning. It's not quite the holy grail of "connect this device to the internet anywhere in the world and get hacked within minutes", but it's coming close.
- ncmncm 4y ago
- phendrenad2 4y agoWhy is this certain? Nobody has written a wifi stack, or even a single wifi driver, for Linux. Until they do, we won't know if Rust will help with these kinds of security flaws.
- pjmlp 4y agoIt remains to be seen how the new Bluetooth stack introduced in Android 11 will get exploits. The old one has plenty of them to show off due to typical memory corruptions handling network packets.
- kibwen 4y agoEven as a Rust user, I'd prefer to reduce the attack surface by having a userspace network stack. Tanenbaum gets the last laugh. Of course, once it's in userspace you can write it in whatever language you want. But as a network-facing component, yes, it should preferably be written in a memory-safe language as much as possible, since it's extremely high-risk and the first target for remote adversaries.
- ncmncm 4y agoPromoting Rust might feel good, but it does not have the desired effect. Promoting action that would have the desired effect would tend more to have the desired effect, even though less personally gratifying. Your choice, but being seen to choose reveals.
- deleted 4y ago[deleted]
- pjmlp 4y agoRust isn't the only game in town moving into safer lands. > Swift adoption continues its exponential climb and surpassed C++ this year. From https://blog.timac.org/2022/1005-state-of-swift-and-swiftui-ios16/ https://blog.timac.org/2022/1005-state-of-swift-and-swiftui-... > I propose that we start requiring an existing Swift compiler to build the Swift compiler. This opens the door to non-optional (mandatory) parts of the compiler to be implemented in Swift. From https://forums.swift.org/t/implementing-parts-of-the-swift-compiler-in-swift/59524 https://forums.swift.org/t/implementing-parts-of-the-swift-c...