Researcher showcases Wi-Fi worm that can leave billions of Android and iOS devices vulnerable

At the recently held **Black Hat security conference** in Las Vegas, security researcher Nitay Artenstein of Exodus Intelligence showcased a self-replicating Wi-Fi worm that can leave billions of Android and iOS  devices vulnerable. [caption id=“attachment_3872563” align=“alignleft” width=“380”] Representational image.[/caption] As reported by ArsTechnica, Artenstein demonstrated a proof-of-concept attack that exploited a vulnerability found in Wi-Fi chipsets that were manufactured by Broadcom. The security researcher from Exodus Intelligence showcased how the attack code fills the airwaves with probes that prompt devices for connections. Once these requests reach a device with a broadcom chipset of the BCM43xx family, the attack first rewrites the firmware of the chip and then begins sending replicated malicious packages to other devices. Once executed, it literally sets off a chain reaction that can quickly compromise a number of iOS and Android devices, especially those that have not been updated, leaving them at the mercy of the attacker. While it does sound like a doomsday scenario, the code was demoed at the Black Hat conference. Lucky for most of us, the vulnerability that lets the attack code replicate and spread malicious packages has already been plugged in recent Android and iOS security patches. According to Artenstein, the worm dubbed “Broadpwn” would have made up to 1 billion devices vulnerable. In his detailed blog post, Artenstein noted that the research was simply an attempt to demonstrate what such an attack is capable of and what the bug would look like. The code is based on a 0-day that allowed the team to leverage the same into a fully remote exploit.