NexMon is a firmware patching framework for the BCM4339 WiFi firmware of Nexus 5 smartphones.
Darmstadt, Germany
Joined August 2016
- Tweets156
- Following74
- Followers753
- Likes87
NexMon retweeted
Meet the MASTERS of wireless reverse engineering! @kalilinux NetHunter Episode 2 is out now! It was a pleasure to have the @nexmon_dev team on 📱⌚📡 @offsectraining youtu.be/6FNd77iu2W0
NexMon retweeted
We published a pre-print paper about AirGuard. How does the app work? How does it perform against the iOS tracking detection and what can we learn from the anonymous data shared by the user?
arxiv.org/abs/2202.11813
NexMon retweeted
The remaining @acm_wisec tutorials are online: open-sourcing research projects by Milan (@seemoolab), firmware reverse engineering with Ghidra by @ghidraninja, firmware rehosting with avatar2 by @nSinusR and details on a 5G testbed by @gvinevere (@5g_lab & @ComNets_TUD).
A new tutorial format at @acm_wisec features practical tools for wireless research. 👩💻📱📶
SDR intro by @bastibl, baseband fuzzing by @domenuk, iOS in-process fuzzing by @ttdennis & Bluetooth firmware mods by me. Ping me if you want to join as speaker.
sites.nyuad.nyu.edu/wisec21/…
NexMon retweeted
The paper is online – reverse engineered details on WiFi password sharing and Handoff on Apple devices.
usenix.org/system/files/sec2…
Our paper “Disrupting Continuity of Apple’s Wireless Ecosystem Security” has been accepted by Usenix Security 21.
It details in reverse-engineering private protocols on Apple‘s Hard- & Software and it includes two reversed protocols: Handoff and WiFi Password Sharing.
#usesec21
Very nice that you finally found the shared memory regions between Wi-Fi and Bluetooth chip. As nexmon just patches the Wi-Fi firmware before loading it, we could try to load a patched Wi-Fi firmware using the Bluetooth chip and then reset the Wi-Fi chip to start it.
Code execution on a Broadcom Bluetooth chip leads to code execution within Wi-Fi. This has a couple of interesting implications for utilizing Wi-Fi without @nexmon_dev 📱, Wi-Fi debugging 🐛, and exploitation 💥
More details on CVE-2020-10367 (unpatched): naehrdine.blogspot.com/2021/…
Happy Easter! Today I published our monitor mode and frame injection patches for the BCM4375 Wi-Fi chips installed in Samsung Galaxy S10 and S20 smartphones.
I am still looking for access to a Galaxy S21 to analyze its firmware. nexmon.org #nexmon
NexMon retweeted
We reverse-engineered @Apple's Find My network for tracking offline #Bluetooth devices. Corresponding paper at @PET_Symposium. Create your own #AirTags today: github.com/seemoo-lab/openha…
Take a look at github.com/reinhardh/dna_rs_… to decode the first episode of biohackers encoded in DNA on de.biohackersnetflix.com/
NexMon retweeted
It's online! Bluetooth RCE == Wi-Fi RCE. Say hello to Spectra, the concept of breaking wireless chip separation as they share the same spectrum. #BlackHat
blackhat.com/us-20/briefings…
NexMon retweeted
Since people were asking how it works internally, here is Jan's final presentation, which covers the most important aspects why ARM Thumb2 disassembly was problematic and how the binary-only approach works. (9/8)
github.com/seemoo-lab/polypy…
NexMon retweeted
Jan just released Frankenstein, the Broadcom/Cypress Bluetooth firmware emulator that enables fuzzing and further kinds of debugging. It works within a fully-functional Linux BlueZ stack and features virtual modem input. (1/2)
github.com/seemoo-lab/franke…
Someone turned the Raspberry Pi into a GSM text message sniffer without any extra hardware using the Broadcom Bluetooth chip:
heise.de/select/ct/2020/8/20…
github.com/huhtikuu/huhtikuu
NexMon retweeted
Qualcomm QCACLD with monitor mode is served.
Brings sniffer capabilities to a bunch of Android devices.
I'll update the paper as we go this week,
but now, ENJOY!
@aircrackng @kalilinux @nexmon_dev
@digi_no @TheHackersNews
github.com/kimocoder/qualcom…
NexMon retweeted
While you are all about hacking and breaking things, we built some cool wireless stuff with InternalBlue and @nexmon_dev, which we will present at #EWSN2020, February 17-19, Lyon, France. Happy to meet and chat if you are around, either at the conference or in Lyon.
NexMon retweeted
36C3: Vertraue keinem Bluetooth-Gerät – schon gar nicht im vernetzten Auto heise.de/newsticker/meldung/… #36c3 #36C3
