qkaiser_

I probably need to adapt the wording then.

Broadcom released an insufficient patch in 2018, then they moved to hostapd in their SDK. So as an OEM you can get the support of Broadcom to move to a fixed revision.

The whole issue is not that Broadcom has a bug, everyone has, it’s that their communication did not make its way down the supply chain.

They said they notified OEMs but refused to share the content with me. So we don’t know whether it was a single line in a changelog or an actual security advisory.

Since every OEM is not keeping track of all vendor communications, a proper CVE would have alerted the OEMs to take action 8 years ago I think.

that’s a possibility because firmware signing and authentication is not implemented by these devices. On Linux devices the patch would be to simply get rid of wps_monitor, which is only in charge of WPS/WSC anyway.

On eCos you could do it through binary patching so the WPSM real-time task is not launched. I’ve heard of ISP doing that when Cable Haunt was released. Not sure all of them would be okay with this given the risks of pushing a really bad update.

yes. In my talk there’s a slide where I guesstimated a worldwide impact in the low hundred millions.

We will only ever know once the ISPs come forward with exact numbers.