Despite Apple’s and Google’s best efforts to keep our smartphones safe, new vulnerabilities always crop up. Traditionally, they are exclusive to a device, or maybe several versions of a device’s firmware — and hopefully, they are dealt with swiftly. Unfortunately, a new gap has been discovered that transcends operating systems, delivering malware in a way we have not seen before.
The exploit attacks a phone’s Wi-Fi chip and because multiple manufacturers source their wireless equipment from the same company, it can be carried out across devices. Broadcom produces the tech used in some of the market’s top devices, like the Galaxy, Nexus, and iPhone brands. Appropriately, the scheme has been named “Broadpwn,” according to The Guardian.
Researcher Nitay Artenstein revealed the flaw at the Black Hat security conference in Las Vegas on Thursday. Fortunately, it has just been patched. If you have updated to the recently released iOS 10.3.3 or Android’s July security fix, your phone is no longer susceptible to the attack.
As for how it works, hackers have been able to take advantage of common flaws found in a number of Broadcom’s chips to write and push code that can directly inhibit a phone’s Wi-Fi capabilities. Through this, they gain full control over the component and can even engineer the malware to self-replicate and automatically move to the next-closest device all on its own.
According to Artenstein, the method requires very little intervention on the part of the hacker. Everything can be carried out remotely, without knowledge of the specific device being targeted. It is so discreet, there is no sign to tip the owner off that they have been infected.
It sounds like a doomsday scenario — especially the self-replicating part — though thankfully the exploit only concerns the Wi-Fi chip and cannot be used to gain access to the device at this time.
While the vulnerability has been patched for users of the newest devices receiving the latest security updates, owners of older hardware will regrettably be left out in the cold. Under Google’s current policy for its own products, like the Pixel, system updates are no longer issued two years after release, while security updates wrap up after three. That is standard practice in the Android industry and unfortunately, the best owners can really hope for. Most manufacturers struggle to get crucial updates out in a timely manner and some never even get around to it.
