Broadcom-WPSplinter: Detection results

[derv82]

This is a catch-all for WPSplinter / broadcom-wps detection in wifit3.

About WPSplinter

WPSplinter by @qkaiser: https://qkaiser.github.io/broadcom-wps/

Broadcom’s legacy WPS Monitor implementation does not correctly constrain reassembled EAP-WPS fragments to the size of its destination buffer.
A nearby attacker can reach the parser over Wi-Fi without knowing the network key or completing WPS enrollment.
On vulnerable devices, this can cause controlled memory disclosure and arbitrary code execution.

...And I remember seeing a PoC showing a router echoing the PSK to UART.

The qkaiser/broadcom-wps repo has scripts to fingerprint over-the-air (via Scapy) and YARA signatures for firmware binaries.

---

Detection in wifit3 is in review: #136

(PR includes instructions to fetch & run)

I'm adding detection to wifit3's WPS probe ("may be vulnerable" / "runs Broadcom wps_monitor" / "hostapd, unaffected" / etc). "may be vulnerable" identifies Broadcom's wps_monitor, but cannot tell if the firmware is patched.

---

Attacks

wifit3 will be detection-only for now.

Share your results! Useful: router make/model, firmware version, the probe's log lines, and YARA hits from qkaiser/broadcom-wps on the firmware. Only probe your own hardware.

[DensenDeluxe]

seems vodafone rolled out a patch in my region - script working fine

13:55:15 ● Identity probe on Vodafone-XXXX (CH 11)
13:55:15 ├─► broadcom-wps: hostapd, unaffected
13:55:16 └─✓ probe matched: Vantiva USA Broadcom
13:55:16 Router identity
13:55:16 ├─► Vantiva USA Broadcom
13:55:16 ├─► Model: Broadcom (WSC M1)
13:55:16 ├─► Manuf: Vantiva USA (IEEE OUI)
13:55:16 ├─► Device: BroadcomAP (WSC M1)
13:55:16 └─► Chipset: Broadcom (WSC)

---

13:56:54 ● Identity probe on Vodafone-XXXX (CH 6)
13:56:55 ├─► broadcom-wps: hostapd, unaffected
13:56:55 └─✓ probe matched: Vantiva USA Broadcom
13:56:55 Router identity
13:56:55 ├─► Vantiva USA Broadcom
13:56:55 ├─► Model: Broadcom (WSC M1)
13:56:55 ├─► Manuf: Vantiva USA (IEEE OUI)
13:56:55 ├─► Device: BroadcomAP (WSC M1)
13:56:55 └─► Chipset: Broadcom (WSC)

---

13:58:03 ● Identity probe on Vodafone-XXXX (CH 6)
13:58:03 ├─► broadcom-wps: hostapd, unaffected
13:58:04 └─✓ probe matched: Vantiva USA Broadcom
13:58:04 Router identity
13:58:04 ├─► Vantiva USA Broadcom
13:58:04 ├─► Model: Broadcom (WSC M1)
13:58:04 ├─► Manuf: Vantiva USA (IEEE OUI)
13:58:04 ├─► Device: BroadcomAP (WSC M1)
13:58:04 └─► Chipset: Broadcom (WSC)

---

14:03:44 ● Identity probe on Vodafone-XXXX (CH 11)
14:03:54 ├─► broadcom-wps: inconclusive
14:03:55 └─✓ probe matched: Vantiva USA Broadcom
14:03:55 Router identity
14:03:55 ├─► Vantiva USA Broadcom
14:03:55 ├─► Model: Broadcom (WSC M1)
14:03:55 ├─► Manuf: Vantiva USA (IEEE OUI)
14:03:55 ├─► Device: BroadcomAP (WSC M1)
14:03:55 └─► Chipset: Broadcom (WSC)

[4p3rtur3]

17:52:01 Target acquired: WLAN-1337
17:52:01 ├─► Encryption: WPA2 (PSK)
17:52:01 ├─► BSSID: 4c:09:d4:00:00:00
17:52:01 └─► Tuned to channel 1
17:52:15 ● Identity probe on WLAN-1337 (CH 1)
17:52:26 ├─► broadcom-wps: may be vulnerable
17:52:26 ├─► runs Broadcom wps_monitor
17:52:26 ├─► derv82/wifit3 discussion#135
17:52:31 └─✓ probe matched: ARCADYAN DT724
17:52:31 Router identity
17:52:31 ├─► ARCADYAN DT724
17:52:31 ├─► Model: DT724 (WSC M1)
17:52:31 ├─► Manuf: ARCADYAN (WSC M1)
17:52:31 └─► IEEE OUI: Arcadyan

MAC-Segment: 4C:09:D4:00:00:00 - 4C:09:D4:FF:FF:FF (MA-L)
Manufacturer: Arcadyan Corporation
Address: 4F, No. 9, Park Avenue II, Hsinchu 300, TW

---

01:32:00 Target acquired: WLAN-1338
01:32:00 ├─► Encryption: WPA2 (PSK)
01:32:00 ├─► BSSID: 5c:dc:96:00:00:00
01:32:01 └─► Tuned to channel 11
01:32:28 ● Identity probe on WLAN-1338 (CH 11)
01:32:34 ├─► broadcom-wps: may be vulnerable
01:32:34 ├─► runs Broadcom wps_monitor
01:32:34 ├─► derv82/wifit3 discussion#135
01:32:40 └─✓ probe matched: ARCADYAN DT724
01:32:40 Router identity
01:32:40 ├─► ARCADYAN DT724
01:32:40 ├─► Model: DT724 (WSC M1)
01:32:40 ├─► Manuf: ARCADYAN (WSC M1)
01:32:40 └─► IEEE OUI: Arcadyan

MAC-Segment: 5C:DC:96:00:00:00 - 5C:DC:96:FF:FF:FF (MA-L)
Manufacturer: Arcadyan Corporation
Address: No.8, Sec.2, Guangfu Rd., Hsinchu City 30071, 12345, TW

[4p3rtur3]

Target acquired: gigacube-1337
├─► Encryption: WPA2 (PSK)
├─► BSSID: 34:12:f9:00:00:00
└─► Tuned to channel 5
● Identity probe on gigacube-1337 (CH 5)
├─► broadcom-wps: may be vulnerable
├─► runs Broadcom wps_monitor
├─► derv82/wifit3 discussion#135
└─✓ probe matched: HuaweiAP
Router identity
├─► HuaweiAP
├─► Model: HuaweiAP (WSC M1)
├─► Manuf: Huawei (WSC M1)
└─► IEEE OUI: Huawei Technologies

MAC-Segment: 34:12:F9:00:00:00 - 34:12:F9:FF:FF:FF (MA-L)
Manufacturer: HUAWEI TECHNOLOGIES CO.,LTD
Address: No.2 Xin Cheng Road, Room R6,Songshan Lake Technology Park, Dongguan 523808, CN

---

Target acquired: WLAN-123456
├─► Encryption: WPA2 (PSK)
├─► BSSID: 58:d7:59:00:00:00
└─► Tuned to channel 1
● Identity probe on WLAN-123456 (CH 1)
├─► broadcom-wps: may be vulnerable
├─► runs Broadcom wps_monitor
├─► derv82/wifit3 discussion#135
└─✓ probe matched: Huawei Technologies Broadcom
Router identity
├─► Huawei Technologies Broadcom
├─► Model: Broadcom (WSC M1)
├─► Manuf: Huawei Technologies (IEEE OUI)
├─► Device: BroadcomAP (WSC M1)
└─► Chipset: Broadcom (WSC)

MAC-Segment: 58:D7:59:00:00:00 - 58:D7:59:FF:FF:FF (MA-L)
Manufacturer: HUAWEI TECHNOLOGIES CO.,LTD
Address: No.2 Xin Cheng Road, Room R6,Songshan Lake Technology Park, Dongguan 523808, CN

[xxcosita3czxx]

I think i saw few vodafone gigacubes that showed to be vulnerable, i think by hardware they were v1, and of course tplink archers

[xxcosita3czxx]

Kaon - O2SMARTBOX seems to be vulnerable