Аюулгүй байдлын судлаачдын илрүүлснээр Broadcom-ийн чип ашигладаг сая сая роутер нууц үг шаардахгүйгээр хакеруудын гарт орох эрсдэлтэй байна.
Кибер аюулгүй байдлын судлаач Квентин Кайзер Broadcom-ийн Wi-Fi программ хангамжид “WPSplinter” гэж нэрлэгдсэн, 2010 оноос хойш оршиж буй хоёр ч эмзэг байдлыг илрүүлжээ. Энэхүү цоорхой нь Wi-Fi Protected Setup (WPS) функцийг ашиглан роутерын санах ойг гэмтээж, сүлжээний нууц үггүйгээр төхөөрөмжид нэвтрэн өөрийн кодыг ажиллуулах боломжийг халдагчдад олгодог байна.
Судлаачийн мэдээлснээр Broadcom компани 2018 онд энэ асуудлын талаар мэдээлэл авч, хэсэгчилсэн засвар гаргасан ч бүрэн шийдэж чадаагүй аж. Кайзер Бельгийн Proximus, Orange, VOO зэрэг үйлчилгээ үзүүлэгчдийн ашигладаг роутерууд дээр туршилт хийхэд халдагчид Wi-Fi нууц үгийг санах ойгоос нь хулгайлах боломжтойг баталжээ. Зөвхөн Бельги улсад гэхэд 1.56 сая орчим төхөөрөмж эрсдэлд ороод байгаа бөгөөд дэлхий даяар Broadcom-ийн чип ашигладаг олон зуун бүтээгдэхүүн хамрагдах магадлалтай байна.
Broadcom компани уг эмзэг байдлын талаар мэдээлэл авсан ч CVE танигч оноохоос татгалзаж, үйлдвэрлэгчдэд нээлттэй эхийн “hostapd” программ хангамж руу шилжихийг зөвлөсөн байна. Хуучин eCos суурьтай чип ашигладаг BCM3380, BCM3383, BCM33834 зэрэг загварууд нь огт засварлагдахгүй байх магадлалтай тул судлаач үүнийг “мөнхийн цоорхой” хэмээн нэрлэжээ.
Кайзер уг судалгааг хийхдээ хиймэл оюун ухааны загваруудыг ашигласан нь ажлын бүтээмжийг эрс нэмэгдүүлж, хэдэн сар үргэлжлэх байсан ажлыг долоо хоног хүрэхгүй хугацаанд дуусгахад тусалсан гэв. Аравдугаар сарын 15-ны байдлаар түүний илрүүлсэн эмзэг байдал бүхий төхөөрөмжүүдэд ямар нэгэн програм хангамжийн засвар хийгдээгүй хэвээр байна.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
A 16-year-old security flaw in Broadcom’s Wi-Fi software could let attackers hijack millions of routers without knowing the network password, even though the chipmaker reportedly knew about the problem since 2018. Security researcher Quentin Kaiser disclosed the vulnerability, dubbed “WPSplinter,” revealing two bugs in Broadcom’s proprietary Wi-Fi implementation that date back to at least 2010. An attempted fix arrived eight years later, but Kaiser claims it didn’t fully resolve the problem. The bugs lie in Broadcom’s handling of Wi-Fi Protected Setup (WPS), the feature that lets users connect devices to a wireless network without manually entering a password. Kaiser found that specially crafted WPS messages could corrupt the router’s memory, allowing someone within Wi-Fi range to run their own code on the device. They wouldn’t need the Wi-Fi password, and the router’s owner wouldn’t have to do a thing. Kaiser demonstrated working exploits against routers supplied by Belgian internet providers Proximus and Orange. In one attack against an ASKEY TCG3000 gateway, he ran code on the device, pulled its Wi-Fi password from memory, and sent it back over the air. He then used the stolen credentials to join the network. He also found the flaw in Netgear and Technicolor routers supplied by VOO. He estimates that around 850,000 Proximus gateways could be affected, along with 500,000 at VOO and 210,000 at Orange Belgium. That puts the potential total at 1.56 million routers in Belgium alone, although Kaiser admits the figures are rough estimates. However, the problem is unlikely to stop at the Belgian border. Broadcom’s Wi-Fi technology is used by dozens of manufacturers across hundreds of products, meaning the number of affected devices worldwide could be considerably higher. According to Kaiser, the chipmaker knew about the vulnerability back in 2018 and released a partial fix without publicly disclosing the problem. It subsequently recommended that manufacturers move away from its proprietary implementation and use the open-source hostapd software instead. Owners of routers running Broadcom’s older eCos-based chips, including the BCM3380, BCM3383, and BCM33834, are in a particularly grim position. Kaiser calls the flaw a “forever day,” meaning those devices may never get a fix. Routers using Linux-based BCM3390, BCM65xx, and BCM68xx chips aren’t necessarily off the hook either, unless their manufacturers switch to hostapd. That leaves some older routers with no obvious route to a fix, while others depend on their manufacturers updating software that may be years out of support. Kaiser first reported the vulnerabilities to Broadcom on July 18, followed by a second report on July 27, giving the company and affected vendors 90 days before public disclosure. Broadcom responded on July 28 to say a patch was available and advised him to contact affected manufacturers directly. The following day, however, the company declined to assign a CVE identifier or provide him with a copy of the notification it said it had sent to manufacturers through its customer portal. Kaiser also contacted Proximus, attempted to reach Orange Belgium and VOO, and passed his findings to Belgium’s national cybersecurity authorities. He subsequently opened a case with CERT/CC, which closed it on August 4 because Broadcom was itself a CVE Numbering Authority and had declined to register the vulnerability. By October 15, a day before his presentation, Kaiser said none of the affected devices he had identified had received a patch. Kaiser hasn’t reported evidence of attacks in the wild, but the potential for mischief is considerable. Someone parked outside a home or office could potentially compromise a vulnerable router, steal network credentials, or use their access to interfere with traffic. Kaiser also credited AI with speeding up the investigation. He reckons the work would ordinarily have taken him months, but with the help of frontier models, he finished it in less than a week. ®
