A 16-year-old flaw in Broadcom chips lets attackers hijack millions of home routers worldwide over WiFi. Researcher Quentin Kaiser disclosed the bug , dubbed WPSplinter , at the Hexacon conference in Paris. The defect is in Broadcom’s legacy WPS code, which connects devices via a button press rather than a password. Flawed message handling lets an attacker who sends the right sequence read router memory or execute external code, no WiFi password or completed WPS pairing is needed. Radio range alone suffices, and Kaiser says the attack works over long distances. This differs from the WPS PIN weakness of the early 2010s; the fault is Broadcom’s code, not WPS itself. Kaiser demonstrated live attacks. On an Askey TCG3000 gateway from Orange Belgium, his exploit extracted the Wi-Fi key from device memory, sent it over the air, and used it to join the network. On a Proximus BBOX3V+ made by Sagemcom, he gained a remote shell entirely over Wi-Fi, with no internet connectio...
A 16-year-old flaw in Broadcom chips lets attackers hijack millions of home routers worldwide over WiFi. Researcher Quentin Kaiser disclosed the bug, dubbed WPSplinter, at the Hexacon conference in Paris.
The defect is in Broadcom’s legacy WPS code, which connects devices via a button press rather than a password. Flawed message handling lets an attacker who sends the right sequence read router memory or execute external code, no WiFi password or completed WPS pairing is needed. Radio range alone suffices, and Kaiser says the attack works over long distances. This differs from the WPS PIN weakness of the early 2010s; the fault is Broadcom’s code, not WPS itself.
Kaiser demonstrated live attacks. On an Askey TCG3000 gateway from Orange Belgium, his exploit extracted the Wi-Fi key from device memory, sent it over the air, and used it to join the network. On a Proximus BBOX3V+ made by Sagemcom, he gained a remote shell entirely over Wi-Fi, with no internet connection on his end.
He confirmed the bug on gateways from three of Belgium’s four major providers: VOO, Orange and Proximus. He counts about 1.5 million vulnerable devices in Belgium alone. Because routers with the same Broadcom chips sell worldwide, his incomplete list includes models from Cisco, Netgear, Nokia, Sagemcom, TP-Link, ZTE and Zyxel, used by providers like KPN, Movistar, Optus and Turk Telekom. That points to a global estimate in the low hundreds of millions.
Broadcom says it has known since 2018, has replaced the old WPS code, and told Kaiser to contact device makers. Kaiser says the 2018 patch was incomplete. Broadcom also refused a CVE, calling the code obsolete and outside its support window. Without a CVE, Kaiser argues, the warning never reached router makers and internet providers.
Disabling WPS is an option, but Kaiser warns it may not fully disable the vulnerable code. If your provider’s firmware is uncertain, turn off the gateway’s Wi-Fi, set it to bridge mode, and use your own updated router. Kaiser has published a detection script on GitHub for checking hardware.
This article, WPSplinter flaw lets attackers hijack millions of routers over WiFi, was originally published at NoypiGeeks | Philippines Technology News, Reviews and How to's.
Comments
Post a Comment