{"id":1315,"date":"2019-01-22T09:27:37","date_gmt":"2019-01-22T01:27:37","guid":{"rendered":"https:\/\/tongwing.woon.sg\/blog\/?p=1315"},"modified":"2019-01-22T09:31:26","modified_gmt":"2019-01-22T01:31:26","slug":"remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce-embedi","status":"publish","type":"post","link":"https:\/\/tongwing.woon.sg\/blog\/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce-embedi\/","title":{"rendered":"Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi: from zero knowledge to zero-click RCE \u2013 Embedi"},"content":{"rendered":"<p>Marvell Wifi System-on-chip, which is used by Valve Steamlink, PS 4, Microsoft Surface and Samsung Chromebook is <a href=\"https:\/\/embedi.org\/blog\/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce\/\">susceptible to remote compromise<\/a>. Here&#8217;s the kicker: the device can be compromised <em>just by the fact that it&#8217;s powered on<\/em>. There is no need for the victim to visit any website or click on any links.  That&#8217;s what makes this RCE (remote code execution) so dangerous and potent.<\/p>\n<p><a href=\"https:\/\/embedi.org\/blog\/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce\/\"><img decoding=\"async\" class=\"alignnone size-full\" src=\"https:\/\/tongwing.woon.sg\/blog\/wp-content\/uploads\/2019\/01\/marvell1200.jpg\" alt=\"\" \/><\/a><\/p>\n<blockquote><p>This vulnerability can be triggered without user interaction during the scanning for available networks. This procedure is launched every 5 minutes regardless of a device being connected to some Wi-Fi network or not. That\u2019s why this bug is so cool and provides an opportunity to exploit devices literally with zero-click interaction at any state of wireless connection (even when a device isn\u2019t connected to any network).<\/p><\/blockquote>\n<p>Source: <em><a href=\"https:\/\/embedi.org\/blog\/remotely-compromise-devices-by-using-bugs-in-marvell-avastar-wi-fi-from-zero-knowledge-to-zero-click-rce\/\">Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi: from zero knowledge to zero-click RCE \u2013 Embedi<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Marvell Wifi System-on-chip, which is used by Valve Steamlink, PS 4, Microsoft Surface and Samsung Chromebook is susceptible to remote compromise. Here&#8217;s the kicker: the device can be compromised just by the fact that it&#8217;s powered on. There is no need for the victim to visit any website or click on any links. That&#8217;s what [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,27],"tags":[],"_links":{"self":[{"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/posts\/1315"}],"collection":[{"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/comments?post=1315"}],"version-history":[{"count":3,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions"}],"predecessor-version":[{"id":1319,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/posts\/1315\/revisions\/1319"}],"wp:attachment":[{"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/media?parent=1315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/categories?post=1315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tongwing.woon.sg\/blog\/wp-json\/wp\/v2\/tags?post=1315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}