9 ms·
Critical Exploit in MediaTek Wi-Fi Chipsets: Zero-Click Vulnerability
- BLACK_hHOLE2729 2y ago[flagged]
- shadowpho 2y agoExploit is hard to distinguish between a back door here.
- saagarjha 2y agoPosting claims of it being such is pretty easy, though.
- pixl97 2y agoThere is a better middle ground here by saying the company that made it may not have known, but nation state threat actors most likely do. When you see actors at this level set up manufacturing thousands of explosive filled devices at very high production quality, inserting some compromised things like printers or routers in a company network wouldn't be and shouldn't be a surprise.
- hedora 2y agoIf the nation state actors did intentionally backdoor it, then they would have wanted to make it look like incompetence. Here’s a link to the Simple Sabotage Field Manual from the US. It worked well in occupied Europe during WWII: https://archive.org/details/SimpleSabotageFieldManual https://archive.org/details/SimpleSabotageFieldManual
- hunter-gatherer 2y agoOriginal blog: https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-20...
- userbinator 2y agoThe wappd service is primarily used to configure and coordinate the operations of wireless interfaces and access points using Hotspot 2.0 and related technologies. The structure of the application is a bit complex but it’s essentially composed of this network service, a set of local services which interact with the wireless interfaces on the device, and communication channels between the various components, using Unix domain sockets. On the bright side, it doesn't sound like this is in baseband firmware but instead in a "value add" service that isn't 100% necessary to the functioning of the WNIC itself. This reminds me of how some devices come with driver packages that include not just the actual driver software that's usually tiny and unobtrusive, but several orders of magnitude larger bloatware for features that 99% of users don't need nor want. Printers and GPUs are particularly guilty of this.
- dvh 2y ago> The structure of the application is a bit complex I've done some Android development so let me translate that for you: "layers upon layers of dog shit APIs"
- userbinator 2y agoI've done some Android RE and agree with you. It's basically Enterprise Java culture.
- Namidairo 2y agoNot too surprising given what I've seen of their vendor sdk driver source code, compared to mt76. (Messy would be kind assessment) Unfortunately, there are also some running aftermarket firmware builds with the vendor driver, due to it having an edge in throughput over mt76. Mediatek and their WiSoC division luckily have a few engineers that are enthusiastic about engaging with the FOSS community, while also maintaining their own little OpenWrt fork running mt76.[1] [1] https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk-openwrt-feeds/ https://git01.mediatek.com/plugins/gitiles/openwrt/feeds/mtk...
- molticrystal 2y agoIs there any news releases or other information about that program, such as their goals, how much of the feed is merged upstream, etc?
- dylan604 2y agoWhy is it so much of this hardware/firmware feels so much like deploying a PoC to production? Why can't they hire someone that actually knows what they are doing?
- dboreham 2y agoBecause money
- ta988 2y agoBecause you have to over pay all those executives and shareholders.
- fragmede 2y agoHardware companies are bad at making software, and the corollary, software companies are bad at making hardware.
- therein 2y agoIn the middle you have Apple that is getting better at making certain kinds of hardware, worse at some hardware and definitely worse in software.
- 1oooqooq 2y agoi still cannot fathom why in this day and age where people buy any silicon that's available, these C tier vendors don't adopt the PC strategy and completely open their firmwares for open source community.
- userbinator 2y agoFCC regulations around not making it easy to transmit outside of the licensed band tend to cause this.
- hakfoo 2y agoIt feels like they're using software as a solution to a hardware problem. No matter what the software says, or what keys it has set, the hardware should still be hard-configured to honour regional power output limits. This could be something like a block of DIP switches under the cover, so if a user unbolts the case, finds the switch, and toggles it to some country with looser requirements, it's obviously going against manufacturer advice and washes their hands of liability.
- vlovich123 2y agoMaking the code available doesn’t necessarily mean that you can actually flash the image since it can be cryptographically locked down. Or even you support flashing but only let you do certain trusted operations from a signed image.
- fn-mote 2y agoI feel like I'm missing something here. Honestly, if you can't update the firmware you're in the same situation... knowing that you have a critical vulnerability and unable to fix it. Enforcing trusted operations is definitely more work than they are going to do (if it's even possible to "do this right"). In a semi-ideal world, I would look for a vendor that permits only certain ops from a flashed image and hope that their crappy "restriction enforcing" code is also riddled with vulnerabilites so it's really just "follow the rules please".
- 2y ago
- kam 2y agoThey say that OpenWrt 19.07 and 21.02 are affected, but as far as I can tell, official builds of OpenWrt only use the mt76 driver and not the Mediatek SDK.
- hedora 2y agoIt’s similar for Ubiquti: https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d7cc-4fce-9218-c930ce4fa35f https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d... There are vulnerable drivers for some chipsets used by UBNT hardware, but they have zero products that use those drivers.
- usr1106 2y agoIIRC my phone uses a MediaTek chipset. And I vaguely remember the vendor has moved away from MediaTek since because of the ahem quality of those products... No idea how WiFi is done on a phone though. Is there a way to find out whether the phone is affected? I hardly ever use WiFi because I have unlimited cellular data and good coverage, but would still be good to know.
- tetris11 2y agotermux -> "sudo su" and then ls /sys/module (it gives an output similar to lsmod)
- usr1106 2y agoThanks! I had thought about mentioning my phone is not rooted, but then I skipped it because that should be the default...
- AStonesThrow 2y agoBack in the day, shell coders would receive the "Useless Use Of Cat" award. https://news.ycombinator.com/item?id=23341711 https://news.ycombinator.com/item?id=23341711 Today it's giving way to "useless use of su" where admins aren't aware of sudo(8) options like "-s" or "-i"
- tetris11 2y agoSo with termux there is an actual root password set, but it differs from the phone password so it's often forgotten. The termux developers, knowing this, set it such that the default termix user can invoke sudo without a password. It might seem lazy, but its very useful
- AStonesThrow 2y agoI am not sure how passwords are relevant to the pointless chaining of two distinct commands, rather than invoking a straightforward "sudo -s". People writing "sudo su" are simply imitating a common StackExchange idiom without knowing why. "su" requires passwords unless invoked by root. "sudo" may be configured to permit/deny specific commands. So if you write that, then you're saying 'become root via the sudoers(5) config and then fork, exec, become root again via the setuid binary "su", in order to run an interactive shell.' It's a poor habit to be promoting, because it assumes things about the configuration and suggests that "su" is equal to other particular "sudo" maintenance commands, when the point is simply to drop into a root shell, which is a facility provided directly by "sudo", if you'd only read the manual page and learn its options. Nothing will stop you from invoking "sudo -s" without a password, without another fork/exec, without another suid utility carrying a significantly different authentication model.
- RedShift1 2y agoI've been buying laptops with AMD CPU's but they always come with these trash MediaTek RZ616 Wi-Fi cards, why is that? I've been replacing them with Intel Wi-Fi cards, now I have a pile of RZ616 cards ready to become future microplastics :-(
- smilespray 2y agoYou know why. Price.
- zokier 2y agoiwlwifi has its own set of problems, biggest being no AP mode (on 5 Ghz). Also intels firmware license is more restrictive than mediateks, and being fullmac the firmware does lot more of the heavy lifting; I personally prefer softmac more. There simply aren't that many great options out there, gone are the golden days of ath9k.
- 0points 2y agoYou get what you pay for.
- heffer 2y agoLenovo grew unhappy with MediaTek as well and started soldering down Qualcomm chips for WLAN on their AMD platforms only to be burned by buggy firmware/driver interactions on Linux (which they officially sell and support). And Qualcomm stretches themselves rather thin on the mainline kernel side once a chipset generation is no longer the latest. It takes a tremendous amount of vendor pressure to make Qualcomm do anything these days.
- zekica 2y agoIntel sells two versions of their WiFi cards: ones ending in 1 use CNVI protocol and work only with Intel chips. These are sold really cheap to OEMs; ones ending in 0 use standard PCIe and are sold to OEMs for ~$10 more. AMD decided to brand Mediatek's MT7921 and MT7922 as RZ608 and RZ616 to have something to sell to OEMs at the same price point as Intel's xx1 chips.
- tuetuopay 2y ago
- mmsc 2y agoCan the OP's link be changed to the original source, not the advertisement it currently links to? The exploit is documented https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-20...
- armada651 2y agoI don't think that link is necessarily better just because it's the original source. The linked article gives a concise overview, while the blog post spends the first paragraph talking about moving and starting a new job.
- mmsc 2y agoIn general, I would wager that HN prefers intellectual curiosity over overviews. Submission guidelines infer that by stating "Please submit the original source. If a post reports on something found on another site, submit the latter."
- codethief 2y agoSure, though I'd argue in the case of vulnerabilities an overview is particularly valuable. Not everyone wants to dive into the details; in my case what I'm most interested in is whether I (or anyone else at my day job) might be affected.
- freedomben 2y agoI would agree. I would also say that when the secondary article contains a lot of value added above, the original, such as is the case here, the secondary source is better because it is easy to follow its link to the original if that's what you'd like to see. I definitely agree with the guideline around favoring original sources, but this seems like a good time to deviate.
- Retr0id 2y agoTheir exploit development process is interesting, and I like to think I'd have done something similar (that is, compiling an easier-to-exploit version of the application and gradually working up to the real thing)
- xtanx 2y agoI would like to remind people of the 2016 Adups backdoor: > According to Kryptowire, Adups engineers would have been able to collect data such as SMS messages, call logs, contact lists, geo-location data, IMSI and IMEI identifiers, and would have been able to forcibly install other apps or execute root commands on all devices. https://www.bleepingcomputer.com/news/security/android-adups-backdoor-became-active-5-months-affected-43-phone-vendors/ https://www.bleepingcomputer.com/news/security/android-adups...
- phh 2y agoHow is this relevant?
- qhwudbebd 2y agoThe wording of the headline is a bit misleading here. I followed the link thinking it might be a firmware or silicon bug as I have a couple of routers at home with mt76 wifi, but was relieved to find it's just a bug in the vendor's 'sdk' shovelware. I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd.
- Terretta 2y ago> relieved to find it's just a bug in the vendor's 'sdk' shovelware Vendors plural to worry about: “…driver bundles used in products from various manufacturers, including [but not limited to] Ubiquiti, Xiaomi and Netgear.” That said, vendors (plural) say no products use this, e.g. Ubiquiti: https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d7cc-4fce-9218-c930ce4fa35f https://community.ui.com/questions/CVE-2024-20017/b3f1a425-d...
- qhwudbebd 2y agoSorry, yes, my use of 'vendor' here was ambiguous. I meant Mediatek, the chipset vendor.
- vesinisa 2y ago> I'm baffled that anyone even thought about using that, given there's such good mt76 support from mainline kernels with hostapd. Not sure if you noticed but the OpenWRT 21.02.x series (based on mainline kernel 5.4 series) is affected, and these guys generally know their game when it comes to wireless on Linux. So much so that I think the mainline kernel mt76 driver is actually maintained by an OpenWRT developer.
- q3k 2y ago[flagged]
- happosai 2y agoWell it was solved decades ago in Java yet Java apps have proven no more secure in general. It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.
- stavros 2y ago> Java apps have proven no more secure in general Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
- petee 2y agoI think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
- stavros 2y agoA CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".
- sedatk 2y agoAlso, popularity directly affects the number of CVEs.
- bastawhiz 2y agoThis is a nonsense statement unless you note the Java runtime. Java is a language. The runtime is the software that runs the Java code. There's more than one runtime.
- justmarc 2y agoWelcome back to the 90s.
- Retr0id 2y agoIs there some logic to MediaTek's naming conventions, or all their devices just MTxxxx where x is some incremented/random number? I have a device with a mt6631 wifi chip and I'd assume it's unaffected just because it's not mentioned as affected anywhere, but it's hard to tell where it might fit into the lineup.
- eqvinox 2y ago> The affected versions include MediaTek SDK versions 7.4.0.1 and earlier, as well as OpenWrt 19.07 and 21.02. > The vulnerability resides in wappd, a network daemon included in the MediaTek MT7622/MT7915 SDK and RTxxxx SoftAP driver bundle. OpenWRT doesn't seem to use wappd though?
- zekica 2y agoAs a contributor to OpenWrt it makes me wonder why don't people differentiate between OpenWrt and various proprietary vendor SDKs. No one would have referenced Fedora if there was a bug in Nobara.
- caconym_ 2y agoCame here wondering this, as I have several Netgear APs running OpenWRT on my home network. Sounds like I'm in the clear?
- eqvinox 2y agoIf it's a clean upstream OpenWRT, yes. For vendored OpenWRT, all bets are off.
- anthk 2y agoThat's why we need free firmware. I'm tired of Broadcom and Ralink.