Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)

Part two of Project Zero's Over The Air Vol. 2 series, focusing on the firmware running on Broadcom's Wi-Fi SoC in the iPhone 7 as a step toward over-the-air exploitation.

Project Zero revisits Broadcom's Wi-Fi stack through Apple devices, mapping new attack surfaces and building toward a full over-the-air exploit chain against iPhones.

Part two of Project Zero's Over The Air research, escalating from code execution on Broadcom's Wi-Fi SoC to remote kernel code execution on the host.

A look at the Android kernel driver attack surface, summarizing research progress, recurring bug classes, and directions for hardening and future driver security work.

The final part of Project Zero's Over The Air series, completing a remote kernel code execution chain on the iPhone 7 using Wi-Fi communication alone.

Does your phone have a firewall? Does it have antivirus? Should it? I'll wager your laptop does.