Over-the-air remote code execution on the DEF CON 27 badge via Near Field Magnetic Inductance

No ratings

Presented at DEF CON 29 by

Seth Kintigh

The DEF CON 27 badge employed an obscure form of wireless communication: Near Field Magnetic Inductance (NFMI). The badges were part of a contest and while poking through the firmware for hints I noticed a buffer overflow flaw. All it required to exploit it was an oversized packet… via a chip with no datasheet and no documentation on the proprietary protocol. Thus started a 2 year odyssey.