WIFI-Important Remote Attack Surface: Threat is Expanding
summary
A black‑box fuzzer that mutates 802.11 management frames and information elements finds 18 zero-day vulnerabilities in six months by running three modes (AP, station, p2p) and sending frames via monitor mode and SDR or by queuing forged frames into the kernel. Notable, reproducible bugs include a supported rates/operational classes IE overflow that causes Windows BSODs in Intel drivers (AX200 and others) and multiple memory corruptions triggered during association; the root cause is unchecked IE lengths and malformed TLV combinations—proofs‑of‑concept and reversing are provided.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:44Overview
- 1:20Background
- 5:11Association Stage
- 5:35How Does the Mobile Device Access the Wireless Network
- 11:19Owner Ability Discovery Method
- 14:04How To Mutate a Mutated Management Frames during the Interaction
- 14:49Information Element Mutation
- 19:32The Stock Buffer Overflow in the Wi-Fi Driver of Usb Awareness Network Adapter on Windows
- 21:22Poc Demo
related talks
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
37mFinding Vulnerabilities in IoT Embedded Devices Using Linux OS and Open Source Tools
44m"Attacking industrial remote controllers for fun and profit"
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
44mExposing Critical Threats In Millions Of Connected Devices
47mBLEEDINGBIT: Your APs Belong to Us
23mConflicts in Vulnerability Management and Patching