Broadcom Wi-Fi flaw hits notebooks

By

Notebook computers from vendors including Dell, Gateway and HP are subject to a wireless card vulnerability that could allow remote installation and execution of malware.

Broadcom Wi-Fi flaw hits notebooks
Reported as part of the Month of Kernel Bugs project, the vulnerability targets Broadcom wireless device drivers built into many laptops, so the vulnerability is not limited to any one brand. 

Linksys has issued a fix for the vulnerability which should work on all affected Broadcom chips, according to security watchdog the Zeroday Emergency Response Team (ZERT). 

The exploit is carried out when an attacker gets within signal range of a vulnerable wireless card.

The attacker then sends a specially crafted packet of networking information which causes a memory error.

The error gives the attacker access to the system and the ability to execute code and install malware, according to the Month of Kernel Bugs report.

While this exploit is only proof-of-concept and has not been reported as being used by attackers, ZERT warned that it may be actively exploited soon.

The group said in a security advisory: "An exploit is available in the development version of the Metasploit Framework (3.0) and can be used to inject any standard Windows payload into a vulnerable system."

According to ZERT, the exploit can be carried out against any vulnerable system within the attacker's signal range.

The security group said that public areas with Wi-Fi connections, such as coffee bars and airports, would be especially high-risk. The attack cannot be launched over the internet as it requires a direct wireless link to a user's system.

The SANS Internet Storm Center recommends updating the driver and disabling the wireless networking card when not in use, especially in public places. 

The Month of Kernel Bugs project was started by security researcher H D Moore with the goal of pointing out a new software vulnerability every day in November. Past subjects have included Apple's AirPort and Microsoft Windows.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

SA Water plans 'once-in-a-generation' core technology uplift

SA Water plans 'once-in-a-generation' core technology uplift

Log In

  |  Forgot your password?