English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Wireless communication standards and implementations have a troubled historyregarding security. Since most implementations and firmwares are closed-source,fuzzing remains one of the main methods to uncover Remote Code Execution (RCE)vulnerabilities in deployed systems. Generic over-the-air fuzzing suffers fromseveral shortcomings, such as constrained speed, limited repeatability, andrestricted ability to debug. In this paper, we present Frankenstein, a fuzzingframework based on advanced firmware emulation, which addresses theseshortcomings. Frankenstein brings firmware dumps "back to life", and providesfuzzed input to the chip's virtual modem. The speed-up of our new fuzzingmethod is sufficient to maintain interoperability with the attached operatingsystem, hence triggering realistic full-stack behavior. We demonstrate thepotential of Frankenstein by finding three zero-click vulnerabilities in theBroadcom and Cypress Bluetooth stack, which is used in most Apple devices, manySamsung smartphones, the Raspberry Pis, and many others.  Given RCE on a Bluetooth chip, attackers may escalate their privileges beyondthe chip's boundary. We uncover a Wi-Fi/Bluetooth coexistence issue thatcrashes multiple operating system kernels and a design flaw in the Bluetooth5.2 specification that allows link key extraction from the host. Turning offBluetooth will not fully disable the chip, making it hard to defend against RCEattacks. Moreover, when testing our chip-based vulnerabilities on thosedevices, we find BlueFrag, a chip-independent Android RCE.

Frankenstein: Advanced Wireless Fuzzing to Exploit New Bluetooth Escalation Targets