Bluetooth Security Weaknesses Pile Up, While Patching Remains Problematic

Turns out, creating wireless ecosystems for a vast number of different architectures, configurations, and use cases is hard.

The complex nature of Bluetooth continues to cause security problems for the low-powered, short-range wireless technology, with academic researchers releasing a parade of new attacks against the technology in the past few months.
On Sept. 9, the Bluetooth Special Interest Group (SIG) issued a statement regarding two papers released by university researchers that described ways of undermining the security of paired Bluetooth devices in specific circumstances. Last month at the Workshop on Offensive Technologies (WOOT) conference, a group of researchers from Purdue University also showed off several weaknesses that could allow attackers to spoof a device that had previously been paired using the Bluetooth Low Energy (BLE) protocol. And in May, researchers presenting at the IEEE Symposium on Security and Privacy showed off a similar attack that abuses a flaw in the specification to allow the impersonation of a paired device.
The complexity of the Bluetooth ecosystem and the large number of implementations have made security hard to achieve, while the rise in easier-to-use Bluetooth auditing tools, such as the InternalBlue open source toolkit, has made it easier for vulnerability researchers to do their work, says Yossi Oren, a senior lecturer at Ben-Gurion University in Israel and a researcher in the schools Implementation Security Lab.
It used to be difficult to research Bluetooth because the hardware was closed and tightly controlled, Oren says. Recently its been getting much easier to hack Bluetooth ... [because] you dont need any customer radio platform or special technical skills.
The three different attacks — dubbed the
Bluetooth Low Energy Spoofing Attack (BLESA)
, the
Bluetooth Impersonation Attacks (BIAS)
, and
BLURtooth
— demonstrate that the complexity of ensuring security across the diverse connected-device ecosystem has resulted in many potential implementation problems and, in some cases, specification weaknesses.
This is just the latest discovery to involve security issues with Bluetooth connections, said Chris Hauk, consumer privacy champion at PixelPrivacy, a consumer privacy information site, in a statement to Dark Reading. It is a constant back and forth between Bluetooth radio manufacturers, who scramble to fix flaws via firmware updates, and bad actors that scramble to exploit the flaws before theyre fixed.
In a paper published at the USENIX Security WOOT 2020 symposium, for example, researchers from Purdue University
found a way to exploit vulnerabilities
in some implementations of the Bluetooth Low Energy (BLE) protocol and spoof a previously paired device. The attackers device can connect to a Bluetooth-capable device, such as a fitness tracker or wireless earbuds, to gather information on the targeted devices attributes. Using those attributes — and exploiting a weakness in the specification in some cases and implementation issues in others — attackers can masquerade as one of the paired devices.
[E]ven BLE stack implementations correctly following the specification can potentially be susceptible to spoofing attacks, the researchers stated in their paper. For instance, we found that the BLE protocol stack ... used in Linux client devices ... while following the BLE specification correctly, is susceptible to the identified spoofing attack.
The security vulnerabilities found to date can have serious consequences, but because of Bluetooth technologys short range, attacks are usually limited, says Ben-Gurion Universitys Oren.
Using these attacks, you can impersonate Bluetooth devices, inject data into connections between Bluetooth devices and their controllers — for example, fool a motion detector — and take devices offline, making them unusable until you reboot them, he said. All of the attacks assume physical proximity, so they cant be launched across the Internet, but certainly if your adversary can get near you you should be careful.
Unfortunately, patching Bluetooth vulnerabilities remains difficult because security issues need to first be patched by device makers, and then those patches have to be distributed to and applied by every device owner. The result is that many devices are never patched, even if the providers issue an update, PixelPrivacys Hauk said.
Unfortunately, as it has been with previous Bluetooth bugs, sys admins face a nightmare of attempting to patch all vulnerable devices, and thats only if there is a patch available, he said in a statement. It is also unfortunate that standard users of mobile and other devices will not patch their devices if and when a patch becomes available.

Last News
▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Bluetooth Security Weaknesses Pile Up, While Patching Remains Problematic