Wireless Security

Blackhat Report: Wireless Driver Vulnerabilties

This story, more than any other so far, has been getting the most press. We have carefully read the original Washington Post article, watched the video, read the follow-up posting, and I spoke with Larry last night who attended the talk. Here’s what we know:

  • There is a flaw in many wireless device drivers that allows an attacker to remotely exploit vulnerabilities that will gain shell access. It is not clear what privilege level the attacker gain, but considering the availability of privilege escalation exploits, its a moot point.
  • The video demonstrates this attack running against a MacBook Pro with an undisclosed 3rd party wireless card. The built-in Apple wireless drivers are also known to be vulnerable and exploitable. The authors claim that vulnerabilities exist in other wireless drivers, and that exploits can be successful against Windows and Linux.
  • The attack does not rely on hijacking ones wireless connection, as long as you can get the victim to receive the wireless exploit packet, the attack can be successful.
  • They released the video instead of doing a live demo to avoid someone sniffing the wireless network at Blackhat and obtaining a copy of the exploit. The authors are giving the vendors time to released patched versions of the drivers (getting people to install them will be another challenge).
  • Larry reports that the team is also working on similar exploits for Bluetooth and CDMA cell phone technology.
  • The SANS Internet Storm Center has a nice write-up as well. They are recommending, as are we, that you disable you wireless card when not in use and be prepared to upgrade your wireless drivers. If you have an Intel Proset wireless card, you should already be upgrading your drivers.

Paul Asadoorian

Paul Asadoorian

Paul Asadoorian is currently the Principal Security Evangelist for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more. Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable. In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. In 2020 Security Weekly was acquired by the Cyberrisk Alliance. Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python & telling everyone he uses Linux.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.