Spectra: New Wireless Escalation Targets

Wireless Coexistence in Modern Mobile Silicon

To conserve board space and share 2.4 GHz antennas, smartphones and laptops combine Wi-Fi and Bluetooth into single combo chips with shared RAM and internal buses.

Deconstructing Broadcom and Cypress Coexistence Architectures

Jiska Classen and Francesco Gringoli analyze on-chip coexistence protocols, reverse engineering proprietary arbitration logic and shared hardware memory structures.

Lateral Movement Across Wireless Cores

Exploiting coexistence vulnerabilities allows an attacker who compromises the Wi-Fi core over the air to jump directly into the Bluetooth core, establishing stealthy persistence.

Extracting Keystrokes and Hardening Firmware

The researchers demonstrate over-the-air Bluetooth keystroke injection and coordinate security mitigations with silicon manufacturers.