A 16-year-old flaw in Broadcom chips lets attackers hijack millions of home routers worldwide over WiFi. Researcher Quentin Kaiser disclosed the bug , dubbed WPSplinter , at the Hexacon conference in Paris. The defect is in Broadcom’s legacy WPS code, which connects devices via a button press rather than a password. Flawed message handling lets an attacker who sends the right sequence read router memory or execute external code, no WiFi password or completed WPS pairing is needed. Radio range alone suffices, and Kaiser says the attack works over long distances. This differs from the WPS PIN weakness of the early 2010s; the fault is Broadcom’s code, not WPS itself. Kaiser demonstrated live attacks. On an Askey TCG3000 gateway from Orange Belgium, his exploit extracted the Wi-Fi key from device memory, sent it over the air, and used it to join the network. On a Proximus BBOX3V+ made by Sagemcom, he gained a remote shell entirely over Wi-Fi, with no internet connectio...
A 16-year-old flaw in Broadcom chips lets attackers hijack millions of home routers worldwide over WiFi. Researcher Quentin Kaiser disclosed the bug , dubbed WPSplinter , at the Hexacon conference in Paris. The defect is in Broadcom’s legacy WPS code, which connects devices via a button press rather than a password. Flawed message handling lets an attacker who sends the right sequence read router memory or execute external code, no WiFi password or completed WPS pairing is needed. Radio range alone suffices, and Kaiser says the attack works over long distances. This differs from the WPS PIN weakness of the early 2010s; the fault is Broadcom’s code, not WPS itself. Kaiser demonstrated live attacks. On an Askey TCG3000 gateway from Orange Belgium, his exploit extracted the Wi-Fi key from device memory, sent it over the air, and used it to join the network. On a Proximus BBOX3V+ made by Sagemcom, he gained a remote shell entirely over Wi-Fi, with no internet connectio...