BLEEDINGBIT: Your APs Belong to Us
summary
Claims two zero‑days in Texas Instruments BLE chips embedded in Cisco/Meraki/Aruba APs: one is a custom OAD path in Aruba that accepts a hardcoded OAD unlock cookie allowing unauthenticated firmware upload over BLE, the other is a TI stack parser bug where the header length bits mismatch causes an out‑of‑bounds copy and memory corruption. Exploitation uses packet spraying, debugger reverse‑engineering, a drone demo, and a tiny 32‑byte shellcode backdoor to reach the AP console and pivot into the network.
AI-written summary · about
chapters (33)
- 0:00Intro
- 1:22Agenda
- 3:09Why Bluetooth Low Energy?
- 4:20Why do APs support BLE?
- 6:44BLE Attack surface
- 8:45OTA solutions over BLE
- 11:21BLE in Aruba Access Points
- 12:12OAD in General
- 13:02OAD in Aruba Access Points
- 13:19Extracting BLE firmware
- 13:44Analyzing custom OAD
- 15:38OTA OAD OMG
- 17:47What would a BLEEDINGBIT attack look like? black hat
- 22:47BLE Discovery
- 23:24BLE link layer
- 24:47TI CC2640 Architecture
- 26:11CC2640 Memory Corruption
- 27:48Lets try and crash it
- 29:33Packet Length: Main Core vs Radio Core black hat
- 30:07Case Study
- 30:37What is being overwritten?
- 31:35Where will the overflow data come from? black hat
- 32:11Inter-core communication
- 32:50Overflow mechanics
- 33:51Spray
- 34:44Exploit strategy
- 35:32Size limitation
- 35:58Tasks at hand
- 37:37Making our first success last forever black hat
- 39:18Restoring execution - Take 1
- 40:15Restoring execution - Take 2
- 40:53Installing a backdoor
- 42:18Shellcode
related talks
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
27mWIFI-Important Remote Attack Surface: Threat is Expanding
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
45mOutside the box: pwning IoT devices through their applications
44mExposing Critical Threats In Millions Of Connected Devices
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
29mBackdooring of Real Time Automotive OS Devices