Bluetooth Bugs Allow Impersonation Attacks on Legions of Devices
#1
Information 
Quote:Academic researchers have uncovered security vulnerabilities in Bluetooth Classic that allows attackers to spoof paired devices: They found that the bugs allow an attacker to insert a rogue device into an established Bluetooth pairing, masquerading as a trusted endpoint. This allows attackers to capture sensitive data from the other device.
 
The bugs allow Bluetooth Impersonation Attacks (BIAS) on everything from internet of things (IoT) gadgets to phones to laptops, according to researchers at the École Polytechnique Fédérale de Lausanne (EPFL) in Switzerland. The flaws are not yet patched in the specification, though some affected vendors may have implemented workarounds.
 
“We conducted BIAS attacks on more than 28 unique Bluetooth chips (by attacking 30 different devices),” the researchers said. “At the time of writing, we were able to test chips from Cypress, Qualcomm, Apple, Intel, Samsung and CSR. All devices that we tested were vulnerable to the BIAS attack.”

The issue lies in the pairing/bonding protocols used in the specification. When two Bluetooth devices are paired for the first time, they exchange a persistent encryption key (the “long-term key”) that will then be stored, so that the endpoints are thereafter bonded and will connect to each other without having to perform the lengthier pairing process every time.
 
For the attacks to be successful, an attacking device would need to be within wireless range of a vulnerable Bluetooth device that has previously established bonding with a remote device with a Bluetooth address known to the attacker.

Read more: https://threatpost.com/bluetooth-bugs-im...es/155886/
[-] The following 1 user says Thank You to silversurfer for this post:
  • harlan4096
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
How I Use Stag VPN for Android Developme...
Hi everyone, As an ...auroralane7754 — 14:09
dGuard Browser Extension 5.1.119 (MV3 st...
AdGuard Browser Ex...harlan4096 — 08:48
Schrödinger’s antivirus: is protection d...
How the research t...harlan4096 — 08:47
AV-Comparatives: Business Security Test ...
The first half-yea...harlan4096 — 08:45
Microsoft reveals when Windows 10 custom...
With Windows 10 re...harlan4096 — 08:39

[-]
Birthdays
Today's Birthdays
avatar (45)RidgeDimb
Upcoming Birthdays
avatar (42)lapedDow
avatar (48)rituabew
avatar (36)omyjul
avatar (40)papedDow
avatar (49)ArnoldFum
avatar (37)yfaza
avatar (48)Kevensi
avatar (38)boineDon
avatar (39)Grompelbawn
avatar (40)vkseogaF
avatar (36)usogy
avatar (39)ywixazok
avatar (37)ixoqe
avatar (35)pa.OpenTran

[-]
Online Staff
harlan4096's profile harlan4096
Administrator

>