Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)

The final part of Project Zero's Over The Air series, completing a remote kernel code execution chain on the iPhone 7 using Wi-Fi communication alone.

Part two of Project Zero's Over The Air Vol. 2 series, focusing on the firmware running on Broadcom's Wi-Fi SoC in the iPhone 7 as a step toward over-the-air exploitation.

Part one of Project Zero's Over The Air series, turning attention from application processors to Wi-Fi chips and finding flaws in Broadcom's widely used Wi-Fi stack.

A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.

A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.

Project Zero revisits Broadcom's Wi-Fi stack through Apple devices, mapping new attack surfaces and building toward a full over-the-air exploit chain against iPhones.