Researchers discover new coexistence attacks on Wi-Fi and Bluetooth chips

Cybersecurity researchers have demonstrated a new attack technique that uses a device's Bluetooth component to extract network passwords directly and manipulate traffic on a Wi-Fi chip.

The attacks work against so-called combo chips: specialised chips equipped to handle different radio-based wireless communications, such as Wi-Fi, Bluetooth and LTE.

"We provide empirical evidence that coexistence — coordinating wireless transmissions across technologies — is an unexplored attack surface," researchers from the Technical University of Darmstadt's Secure Mobile Networking Lab and the University of Brescia said in a new study.

"Rather than escalating directly into the mobile operating system, wireless chips can escalate their privileges into other wireless chips by exploiting the same mechanisms they use to arbitrate access to shared resources, such as the transmit antenna and wireless medium."

Coexistence is a mechanism through which Bluetooth, Wi-Fi and LTE share components and resources, such as an antenna or wireless spectrum. These communication standards must coordinate spectrum access to avoid collisions when operating at the same frequency. Chipset vendors use this principle to let Wi-Fi and Bluetooth operate almost simultaneously.

Although these combined wireless chips are essential for efficient spectrum sharing, coexistence interfaces also pose a side-channel risk. The same researchers demonstrated this at last year's Black Hat security conference, effectively allowing a malicious party to gather information from other wireless technologies supported by the combo chip.

The vulnerability class is called Spectra and relies on transmissions occurring in the same spectrum. Wireless chips must arbitrate channel access. This breaks separation between Wi-Fi and Bluetooth, resulting in denial of spectrum access, information disclosure and even lateral privilege escalation from a Bluetooth chip to code execution on a Wi-Fi chip.

"The Wi-Fi chip encrypts network traffic and holds the current Wi-Fi credentials, providing an attacker with more information," the researchers said. "An attacker can also execute code on a Wi-Fi chip even when it is not connected to a wireless network."

The researchers also found that a malicious user controlling the Wi-Fi core can observe Bluetooth packets. This can reveal keystroke timings on Bluetooth keyboards, ultimately allowing an attacker to reconstruct the text entered.

Although some attack scenarios were first reported to vendors as early as August 2019, coexistence flaws remain unpatched in Broadcom SoCs to this day.

"As of November 2021, more than two years after the first coexistence bug was reported, coexistence attacks, including code execution, still work on up-to-date Broadcom chips," the researchers said. "This highlights how difficult these issues are to fix in practice."

To minimise the risk of such wireless attacks, users are advised to remove unnecessary Bluetooth pairings, delete unused Wi-Fi networks and use mobile data rather than Wi-Fi in public places.

"Mobile data plans have become more affordable in recent years and cellular coverage has increased," the researchers concluded. "Disabling Wi-Fi by default and enabling it only when using trusted networks can be considered good security practice, even if inconvenient."