What’s most fun about the beacon frame crasher is that it can be implemented on an ESP8266 as well. If you can send an ESP8266 a bogus beacon frame or probe response, you can crash it. Because the ESP doesn’t do bounds-checking on this value, a malicious fake access point can send a large number here, probably overflowing a buffer, but definitely crashing the ESP. While connecting to an access point, the access point sends the ESP8266 an “AKM suite count” field that contains the number of authentication methods that are available for the connection. The first flaw is the simplest, and only effects ESP8266s.
He notified Espressif first (thanks!) and they’ve patched around most of the vulnerabilities already, but if you’re running software on any of these chips that’s in a critical environment, you’d better push up new firmware pretty quick. Just came out with three (3!) different WiFi attacks on the popular ESP32/8266 family of chips.
0 kommentar(er)
