Briefly, the attack targets a vulnerability in combo chips – the wireless chips that support multiple wireless technologies. These chips work on a coexistence mechanism to support all the different technologies to work simultaneously on the wireless spectrum without collision. And that is what Spectra attack targets. According to the researchers,
Spectra, a new vulnerability class, relies on the fact that transmissions happen in the same spectrum and wireless chips need to arbitrate the channel access. While coexistence should only increase performance, it also poses a powerful side channel.In their study, the researchers could break the WiFi and Bluetooth separation on the tested chips. In turn, this allowed them to conduct attacks in a way that exploiting the vulnerabilities in one of these could also compromise the other. Hence, this phenomenon expands the attack surface.
For instance, as they explained, a DoS attack on the spectrum can further lead to information disclosure.
The associated packet meta information allows information disclosure, such as extracting Bluetooth keyboard press timings within the Wi-Fi D11 core.Likewise, they also detected a shared RAM region that allowed code execution in WiFi via Bluetooth. Also, code execution within WiFi firmware somehow affected the Android and iOS kernel.
Yet, they fear that similar vulnerabilities might also exist in other combo chips too. Hence, Spectra attack has made vulnerable the hundreds of millions of devices used globally.
The researchers are going to reveal the details of their findings in the upcoming virtual Black Hat USA 2020. At the same time, they will also publish a detailed white paper about their study.
Let us know your thoughts in the comments.
