A 16-year-old flaw in Broadcom chips lets attackers hijack millions of home routers worldwide over WiFi. Researcher Quentin Kaiser disclosed the bug , dubbed WPSplinter , at the Hexacon conference in Paris. The defect is in Broadcom’s legacy WPS code, which connects devices via a button press rather than a password. Flawed message handling lets an attacker who sends the right sequence read router memory or execute external code, no WiFi password or completed WPS pairing is needed. Radio range alone suffices, and Kaiser says the attack works over long distances. This differs from the WPS PIN weakness of the early 2010s; the fault is Broadcom’s code, not WPS itself. Kaiser demonstrated live attacks. On an Askey TCG3000 gateway from Orange Belgium, his exploit extracted the Wi-Fi key from device memory, sent it over the air, and used it to join the network. On a Proximus BBOX3V+ made by Sagemcom, he gained a remote shell entirely over Wi-Fi, with no internet connectio...
Bose has acquired rival audio brand Skullcandy and will run it as a separate brand within its consumer audio division. The purchase price was not disclosed. The two companies have partnered for years, and Skullcandy has released several products with “Sound by Bose,” including its recent Crusher 1080 headphones. Skullcandy will stay based in Park City, Utah, where it was founded. It will also gain access to Bose’s technology and resources, which Bose says will help it grow. For Bose, the deal is about Skullcandy’s audience. The lifestyle-focused brand has a foothold in sports, gaming, music and fitness, areas where Bose has less presence. “For more than 60 years, Bose has been committed to delivering incredible audio experiences however and wherever people choose to listen,” CEO Lila Snyder said. “As we work to reach even more people, we’re expanding how we do that, not only through Bose products, but through technology ...