Friday, May 22nd 2020

'Spectra' Cyber Attack Breaks Coexistence Between Wi-Fi and Bluetooth

Nowadays wireless technologies are increasingly sharing spectrum. This is the case for Wi-Fi and Bluetooth, but also some LTE bands and harmonics. Operating on the same frequency means that these different technologies need to coordinate wireless spectrum access to avoid collisions. Especially for nearby sources, as it is the case for multiple chips within one smartphone, so-called coexistence is the key to high-performance spectrum sharing.

Coexistence between wireless chips can be implemented in various ways. While there are open specifications, most manufacturers opt to develop proprietary coexistence mechanisms to further improve performance. Open interfaces are not needed on combo chips that implement multiple wireless technologies, as the manufacturer has full control.

Spectra, a new vulnerability class, relies on the fact that transmissions happen in the same spectrum and wireless chips need to arbitrate the channel access. While coexistence should only increase performance, it also poses a powerful side channel.

We are the first to explore side-channel attacks on wireless coexistence. We specifically analyze Broadcom and Cypress combo chips, which are in hundreds of millions of devices, such as all iPhones, MacBooks, and the Samsung Galaxy S series. Note that other manufacturers also rely on coexistence and similar attacks might apply.

We exploit coexistence in Broadcom and Cypress chips and break the separation between Wi-Fi and Bluetooth, which operate on separate ARM cores. In general, denial-of-service on spectrum access is possible. The associated packet meta information allows information disclosure, such as extracting Bluetooth keyboard press timings within the Wi-Fi D11 core. Moreover, we identify a shared RAM region, which allows code execution via Bluetooth in Wi-Fi. This makes Bluetooth remote code execution attacks equivalent to Wi-Fi remote code execution, thus, tremendously increasing the attack surface. During code execution within the Wi-Fi firmware, we even experience kernel panics on Android and iOS.

The full technical details along with an academic paper on the attack will be released in August at a virtual session by the Black Hat security conference.
Source: BlackHat USA
Add your own comment

3 Comments on 'Spectra' Cyber Attack Breaks Coexistence Between Wi-Fi and Bluetooth

#1
BiggieShady
We present you Spectra wifi vulnerability, not to be confused with Spectre cpu vulnerability... we shall name the next vulnerabilty we find, Spectro, to make things even more interesting
Posted on Reply
#2
Caring1
Oh noes, not Kernel Panics.
Wait is he on the same side as Major Disaster?
Posted on Reply
#3
_JP_
BiggieShady
We present you Spectra wifi vulnerability, not to be confused with Spectre cpu vulnerability... we shall name the next vulnerabilty we find, Spectro, to make things even more interesting
To all of those as a class of vulnerabilities, we call them 'Specteri', though we accept 'Spectruses' too. We will just frown in disappointment if you choose to call it that.
Posted on Reply