Millions Of Android Devices Using Broadcom Wi-Fi Fighting Tin Last Hacked Remotely

Google has released its latest monthly safety update for Android devices, including a serious põrnikas inward unopen to Broadcom Wi-Fi chipsets that affects millions of Android devices, equally good equally unopen to iPhone models.

Dubbed BroadPwn, the critical remote code execution vulnerability resides inward Broadcom's BCM43xx household unit of measurement of WiFi chipsets, which tin move triggered remotely without user interaction, allows a remote assailant to execute malicious code on targeted Android devices alongside pith privileges.

"The most severe vulnerability inward this [runtime] department could enable a remote assailant using a peculiarly crafted file to execute arbitrary code inside the context of an unprivileged process," Google describes inward the July 2017 Android Security Bulletin.

The BroadPwn vulnerability (CVE-2017-3544) has been discovered past times Exodus Intelligence researcher Nitay Artenstein, who says the flawed Wi-Fi chipset likewise impacts Apple iOS devices.

Since Artenstein volition move presenting his finding at Black Hat 2017 event, details nearly the BroadPwn põrnikas is scarce at this moment.

"The Broadcom BCM43xx household unit of measurement of Wi-Fi chips is works life inward an extraordinarily broad make of mobile devices – from diverse iPhone models to HTC, LG, Nexus in addition to practically the sum make of Samsung flagship devices," the abstract for Artenstein's verbalise says.

Besides the laid for the BroadPwn vulnerability, July's Android Security Bulletin includes patches for 10 critical, which are all remote code execution bugs, 94 high in addition to 32 moderate rated vulnerabilities.

Two months ago, an over-the-air hijacking vulnerability was discovered inward Broadcom WiFi SoC (Software-on-Chip) chips, allowing attackers inside the same WiFi network to remotely hack, iPhones, iPads, iPods in addition to Android handsets without whatever user interaction.

At that time, Apple rushed out an emergency iOS while update to address the serious bug, in addition to Google addressed the flaw inward its Android Apr 2017 safety updates.

Android Security Bulletin: July 2017 Updates

Among the other critical flaws is a long listing of vulnerabilities inward the Mediaserver procedure inward the Android operating system, which likewise allows attackers to perform remote code execution on the affected devices.

One of the vulnerabilities is an number alongside the means the framework handles unopen to specific files. The libhevc library has an input validation vulnerability (CVE-2017-0540), which tin move exploited using a crafted file.

"A remote code execution vulnerability inward libhevc inward Mediaserver could enable an assailant using a peculiarly crafted file to crusade retention corruption during media file in addition to information processing," the vulnerability description says. 

"This number is rated equally Critical due to the possibility of remote code execution inside the context of the Mediaserver process."

The over-the-air updates in addition to firmware for Google devices bring already been issued past times the companionship for its Pixel in addition to Nexus devices, though balance of Android even in addition to hence involve to human face for an update from their OEMs, leaving 1000000 of Android devices vulnerable for side past times side few months.

Share This :