Black Hat USA 2026: two Argentines discovered how to hack antennas that bring internet to isolated areas

The work was presented on the main stage of Black Hat USA 2026, one of the world’s leading cybersecurity conferences, by Gastón Aznarez, principal security researcher at the Argentine company Faraday Security and Federico Kirschbaum, vice president of research at the company.

The analyzed equipment belongs to the platform AirMaxa technology from the American company Ubiquiti used to set up long-distance wireless links. Although they are commonly called “antennas”, they are actually complete communication systems: they combine a directional antenna, a radio, network components and a small operating system. A combo that has everything necessary to attract the attention of a hacker.

These antennas are usually used for bring internet to places where deploying fiber optics or cable is too expensive or directly unfeasible, as is the case in rural or mountain areas of Argentina. Small suppliers install them in roofs, towers or high points to create wireless links of several kilometers: one antenna sends the connection from a point that already has access to the Internet and another receives it in a home, a field or a remote town.

“In the area where I live [Córdoba] There is no fiber optics, so there are several wireless Internet providers. As a result, a large number of houses have one of these antennas installed on the roof, probably without their inhabitants knowing exactly what it is or how it works,” Aznarez explained in dialogue with Clarion.

Unlike Starlinkwhich connects each terminal directly to a satellite network, these devices establish terrestrial links between antennas that must have a relatively clear line of sight.

The vulnerabilities affected seven product families, including airMAX AC, airMAX M, airFiber and GigaBeam. In total, they cover more than 50 models that are still on the market.

According to the researchers, the errors would have been present since the first generations of AirMax technology. Ubiquiti was notified by Faraday in December 2025 and released the first patch in less than ten days. The teams that installed the updates corresponding are already protected against the attacks demonstrated during the investigation.

To understand the scope of the discovery, you first have to understand what these teams do. In a house connected by fiber optics, the data travels through a cable that reaches the home. In many rural regions, suburban neighborhoods or places where deploying fiber is too expensive, That connection can be made through radio waves.

A provider installs one antenna at a high point and places another on the roof of the customer’s house. Both they must point each otheras if they were two opposing reflectors. The signal carries data through the air and allows offer Internet access without running a cable between the two points. This type of company is known as WISP, for wireless Internet service provider.

The technology can also be used to connect buildings of the same company, branches, warehouses or surveillance camera systems. An organization can, for example, place cameras on a remote property and transmit the images to a control room without installing miles of wiring.

The research presented does not imply, it is worth clarifying, that everyone who has one of these devices has been attacked nor that their networks are currently compromised. The discovery demonstrates that unupdated computers could receive a malicious instruction via the wireless signal and hand over control of their operating system.

The presentation was titled Root From Kilometers Awaysomething like “getting full control from miles away.” In systems based on Linux“root” is the account with the highest level of privileges, and can be compared to a “God mode” of a computer: it has permission to modify settings, install programs, stop processes and control practically all the computer’s functions.

“In practical terms, an attacker could take full control of the device without knowing the password, without being connected to the network and without having physical access. “I just needed to be within range of the signal and send a specially designed wireless frame,” explained Dan Borgogno, a security researcher at Faraday, who supported the research.

A plot It is, in simple terms, a small packet of information which is transmitted through the air. Devices constantly receive these types of messages to detect other devices, establish connections, and organize communication.

The vulnerabilities appeared when an antenna received and processed a frame manipulated by the attacker. There was no need to log into an administration page, know the network name, or pre-steal an operator’s credentials.

The attack It didn’t depend on being a few meters from the target either.. These devices are designed precisely to transmit information over long distances. With the right equipment and a reasonably clear line of sight, a signal can reach you from miles away.

To find the vulnerabilities, researchers had to study a system for which there was very little public documentation. AirMax is an extension developed by Ubiquiti on the Wi-Fi standard and its internal workings are proprietary.

The team did reverse engineering, a very common technique among hackers who consists of dismantling logically and technically a system to understand how it works, even if its manufacturer does not publish the source code or a complete description of how it operates. They had to reconstruct the language used by the teams to communicate and analyze the part of the software that processes the data received directly by radio.

During this process, the researchers studied the messages exchanged between the devices and discovered that some fields that appeared to be encrypted They weren’t.

The investigation also highlighted that some of the platforms were still using a Linux kernel that was around 17 years old. The age of a component does not in itself prove that it is insecure: many older systems can be kept protected through fixes and additional controls. But it does make maintenance more difficult and increases the importance of subjecting them to audits.

The main current risk is concentrated in devices who have not installed the updates published by Ubiquiti. In many cases, these antennas are set up once and left running for years. As they are mounted on roofs, towers or places that are difficult to access, They can go unnoticed as long as they continue to serve.

Additionally, some networks keep devices separate from the Internet as a security measure. That isolation reduces certain risks, but it can also prevent the computer from automatically checking for a new version of its firmware, the internal software that controls its operation.

“There are infrastructures that have been operating without problems for years. It is easy for the update to be postponed or forgotten altogether“explained Kirschbaum. Ubiquiti has a centralized management platform that allows equipment to be updated remotely. However, the process depends on each provider, company or network manager monitoring their devices and applying the new versions.

The main protection measure is to update: Ubiquiti fixed the bugs in new versions of airOS for the different affected families. However, this task does not always depend on the user of the home. On many rural links, the antenna is installed and managed by the internet provider, who must apply the update.

The client can check who manages the equipment and ask the vendor to confirm that they are using a corrected version.

In Latin Americawireless links play a relevant role due to the territorial extension, rural areas and the lack of fiber optics in different regions. This does not mean that equipment installed in the region is necessarily more insecure, but rather that there is a large amount of infrastructure that can depend on manual maintenance tasks.

The exhibition also revealed the nature of any wireless communication. When a device transmits by radio, The signal can be received by other equipment that is within its range.

In fact, last year, a researcher showed at DEF CON, the world’s largest hacker conference, how he could access radio communications from airplanes and helicopters without having to hack anything, simply by using the right equipment to listen to the conversations. In the age of artificial intelligence, where a voice can be cloned in minutes, this represents a serious risk.

The case once again puts the focus on so-called embedded systems: devices that include a computer inside, but that do not appear to the user like a traditional PC. Routers, cameras, televisions, cars, antennas and industrial equipment fall into this category.

Many stay on for years and perform critical functions, although they receive less public scrutiny than operating systems like Windows, Android or iOS. “There is very little visibility into its internal workings. This lack of transparency greatly hinders security investigationKirschbaum noted.

“This case is a good example: equipment that has been in operation for more than 15 years has a critical vulnerability that no one had identified. Not necessarily because it was impossible to find, but because investigating proprietary protocols, closed firmware and poorly documented hardware “It requires a lot of time, specialized knowledge and access to devices,” the researcher concluded.

In addition to disclosing the two vulnerabilities, the team developed open source tools to identify and analyze networks that use AirMax. The objective is that other specialists can continue studying an extended infrastructure, but until now little explored.

The investigation was another example of a common problem in technology that operates out of sight of users: essential equipment that remains in operation for years, supported by closed protocols and with few independent audits.

The Argentine label felt strong in one of the main stages of Black Hatwith high-technical research that contributes to the detection of faults and their correction.

Far from the Hollywood image of a remote hack With devastating results, the solution appeared to be something more earthly: updating to the latest version of the system is an effective protection that, curiously, few take into account when managing critical infrastructure.