OTA Remote Code Execution on the DEF CON 27 Badge via NFMI
Seth Kintigh reverse engineers the undocumented NFMI radio protocol on the DEF CON 27 electronic badge, achieving over-the-air remote code execution.
Summary
The Mysterious Wireless Technology of the DC27 Badge
The DEF CON 27 electronic badge used Near Field Magnetic Inductance (NFMI) to communicate with nearby badges during the convention puzzle game.
Reverse Engineering an Undocumented Radio Chipset
With no public datasheet or protocol documentation available, Seth Kintigh reverse engineers the hardware registers, modulation schemes, and packet structures of the NFMI controller.
Discovering a Stack Buffer Overflow in Badge Firmware
Auditing the badge game firmware uncovered a classic stack buffer overflow vulnerability triggered upon parsing oversized wireless NFMI packets.
Executing Over-the-Air Shellcode
Kintigh demonstrates crafting a custom transmitter that broadcasts exploit packets, executing arbitrary code over the air on unpatched badges.
Related talks
Main Stage·43 min
Daniel Jensen
Daniel Jensen details hunting for vulnerabilities across Aruba's on-premises network management and wireless controller appliances, uncovering pre-auth RCE.
Main Stage·39 min
Octavio Gianatiempo · Octavio Galland
Octavio Gianatiempo and Octavio Galland audit top-selling consumer routers, discovering systemic OEM firmware vulnerabilities that enable zero-click remote RCE.
Main Stage·28 min
Michael Whiteley · Katie Whiteley
Badge designers Michael and Katie Whiteley share the behind-the-scenes engineering of the DEF CON 29 badge, overcoming pandemic supply chain crises.