I've just stumbled upon the Pwn2Own Mobile news from three days ago. During which apparently several flagship mobile phones of several manufacturers have (again) been successfully zero-dayed, among these one that I own (the Samsung one).

Available information is obviously, necessarily, sparse.

Sadly, what I can find on the internet is also a bit convoluted, but among much apparent "who cares" stuff, I also found "something something baseband" and "something WLAN", which I combined into "baseband overflow with code execution involving WLAN" (probably?).
Which appears much scarier than whether or not someone can exploit a built-in browser that no one uses anyway, or a JIT exploit (which requires running a maliciously crafted app in the first place).

I understand the use of the word "baseband" in terms of exploiting the Shannon 965 processor or its driver component (is there any such thing at all?) in some way given the condition that... well, what exactly?

The phone being connected to a malicious WLAN and receiving a maliciously formed 802.11 packet? In that case, simply not using other WLANs than the ones you know/control, in particular public ones, should do the trick for mitigating the attack.

WLAN being enabled at all and walking near a malicious WLAN that sends some rogue beacon frame or association request frame, maliciously crafted RTS or ACK, or... whatever? In that case, disabling WLAN when leaving home, or disabling it altogether should do the trick.

The phone being powered on, with WLAN turned off completely, and walking near a malicous WLAN that something, something? Well, that would be bad.

Though security by obscurity is a great thing, it would be helpful to have at least some useful information which might help not in performing the exploit, but mitigating against it, such as e.g. disabling WLAN until a patch is out (if this is fixable at all).

Does anyone happen to have a somewhat better insight into this exploit?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.