New Bluetooth vulnerability lets hackers monitor traffic between devices
The new Bluetooth vulnerability discovered in July 2018 doesn’t have a fancy name like BlueBorne but that doesn’t make it less harmful. Israeli security researchers have published on the 25th Jul 2018 a whitepaper containing the details of the newly discovered Bluetooth flaw. When exploited, the vulnerability allows third parties to carry out a Man in the Middle attack. This means that a malicious user physically close enough to affected Bluetooth devices could intercept and monitor traffic between them. Furthermore, the vulnerability could be used to intercept or forge keystrokes from/to Bluetooth keyboards.
Researchers found that Bluetooth implementations from a number of manufacturers such as Apple, Broadcom, Intel and Qualcomm are affected. The Bluetooth SIG promptly issued a new specification and hardware vendors are currently working on patches. It is currently unknown whether the vulnerability affects Linux Kernel and Microsoft Windows. The vulnerability has been assigned CVE-2018-5383 (you can learn more here).
Here you can find an excerpt from the Vulnerability Notes Database:
Bluetooth utilizes a device pairing mechanism based on elliptic-curve Diffie-Hellman (ECDH) key exchange to allow encrypted communication between devices. The ECDH key pair consists of a private and a public key, and the public keys are exchanged to produce a shared pairing key. The devices must also agree on the elliptic curve parameters being used. Previous work on the “Invalid Curve Attack” showed that the ECDH parameters are not always validated before being used in computing the resulted shared key, which reduces attacker effort to obtain the private key of the device under attack if the implementation does not validate all of the parameters before computing the shared key.
In some implementations, the elliptic curve parameters are not all validated by the cryptographic algorithm implementation, which may allow a remote attacker within wireless range to inject an invalid public key to determine the session key with high probability. Such an attacker can then passively intercept and decrypt all device messages, and/or forge and inject malicious messages.
Both Bluetooth low energy (LE) implementations of Secure Connections Pairing in operating system software and BR/EDR implementations of Secure Simple Pairing in device firmware may be affected.
- 2020 A year in review for Marksei.com - 30 December 2020
- Red Hat pulls the kill switch on CentOS - 16 December 2020
- OpenZFS 2.0 released: unified ZFS for Linux and BSD - 9 December 2020
Recent Comments