BLEEDINGBIT: Your APs Belong to Us
summary
Two zero‑day bugs in Texas Instruments BLE chips (used in Cisco, Meraki, Aruba APs) allow unauthenticated over‑the‑air compromise: an OAD over‑the‑air firmware upgrade weakness lets an attacker upload firmware using a hardcoded unlock ID, and a Bluetooth LE advertising‑length parsing RCE on CC26x40 yields remote code execution via spray+trigger of advertising packets. Exploit chain fits into ~62 bytes of shellcode, installs an 8‑byte in‑memory backdoor, is demonstrated from a drone and can spawn an outbound C2 to persist on the network.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 1:21Agenda
- 3:08Bluetooth Low Energy
- 4:20Use Cases
- 6:44Layers and Functions
- 11:21Aruba
- 13:26MM Compare
- 15:38What can an attacker do
- 17:46How would an attack look like
- 18:20Access to multiple segments
- 19:28Demonstration
- 23:24Packet Structure
- 23:44Length Field
- 24:47TI Architecture
- 30:37Advertising Packet
- 31:35Data Entry Key
- 32:11Data Received
- 33:50Spray
- 35:32Shellcode
- 35:57Task at Hand
- 37:37Preventing Future Overflows
- 38:00Crushing the Chip
- 39:17Restoring Execution
- 40:53Backdoor
- 42:17Backdoor Recap
- 43:05Demo
- 44:48Three takeaways
related talks
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
44mExposing Critical Threats In Millions Of Connected Devices
27mWIFI-Important Remote Attack Surface: Threat is Expanding
51mArm IDA and Cross Check: Reversing the Boeing 787's Core Network
45mOutside the box: pwning IoT devices through their applications
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
57mBlueBorne - A New Class of Airborne Attacks that can Remotely Compromise Any Linux/IoT Device