Google patches pwnable 'droids for Wi-Fi vuln

Re: And will Broadcom release open source drivers?

You really think you'll need *that* much space?

Re: Where does the "remote code execution" happen

According to Nitay's tweets (https://twitter.com/nitayart/status/883221981834997760 and https://twitter.com/nitayart/status/854913203708547073) this new Broadpwn exploit uses a similar attack surface to that reported by The Register in April (https://www.theregister.co.uk/2017/04/05/broadcom_wifi_chip_bugs/), but uses different over-the-air frames (not FT or TDLS) making it easier to deploy. It is surprising that the patches for that original issue did not block at least one of the mechanism on which this new attack depends.

The original Project Zero blog posts provide a very clear explanation of how bugs and insecure coding techniques in multiple layers of the the Wi-Fi chip's firmware, device drivers, and PCIe memory access can be exploited. They are well worth reading while we wait for more details of the latest attack:

https://googleprojectzero.blogspot.co.uk/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html

https://googleprojectzero.blogspot.co.uk/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html

Re: Who updates SIM free phones?

If it is a security update a lot of them do get these straight from Google, but if it an actual OS update it is more complicated.

In theory, ff SIM free it is the manufacturers, if was a carrier tweaked one it is the original carrier.

In practice it seems that it is often neither.

I know this gets said a lot, but this is why my last two phones have been pure Google android so I know that I get all the updates to the OS as soon as possible.

Re: Who updates SIM free phones?

It's something you should check before you buy your phone; how often, and for how long will it get updates?

Which narrows it down to either a Google phone, or something with good 3rd party ROM support.