WiFi firmware bug affects laptops, smartphones, routers, gaming devices

zdnet.com

71 points·DyslexicAtheist··10 comments

Link to disclosure from within the article:

https://embedi.org/blog/remotely-compromise-devices-by-using...

“The researcher says the firmware function to scan for new WiFi networks launches automatically every five minutes, making exploitation trivial. All an attacker has to do is send malformed WiFi packets to any device with a Marvell Avastar WiFi chipset and wait until the function launches, to execute malicious code and take over the device.”

How to know and what to do if my device is affected? Tried googling the chipset name and model with the samsung keyword but didn't get any meaningful results...

(I've got Samsung J2 prime)

A quick look at the coverage suggests this chipset isn't used in phones - some Samsung Chromebooks, though.

Samsung Galaxy J1 smartphone is listed in the article. J2 isn't but just pointing out that at least one phone is on there.

Good point! I see digging through Ifixit teardowns that the Samsung Galaxy Tab 3 7.0 3G used this chipset[1], along with the original Chromecast[2].

1: https://www.ifixit.com/Teardown/Samsung+Galaxy+Tab+3+7.0+3G+...

2: https://www.ifixit.com/Teardown/Chromecast+2015+Teardown/501...

That seems really bizarre. I'm not sure that phone was even expensive enough to be able to fit a separate WiFi chip in its BOM.

I don’t believe any Apple devices are affected — they tend to use Broadcom and Atheros chipsets in their products.

https://www.youtube.com/watch?v=4_nI9ok7iQg

Previous discussion: https://news.ycombinator.com/item?id=18946292

Reply on news.ycombinator.com