IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Bluetooth vulnerability enables hackers to mimic genuine devices

Weaknesses in Bluetooth Core and Mesh Profile Specifications allow impersonation attacks

Hackers could exploit newly discovered flaws in Bluetooth Core and Mesh Profile Specifications to disguise themselves as legitimate devices and carry out man-in-the-middle (MitM) attacks.

Researchers at the Agence nationale de la sécurité des systèmes d'information (ANSSI) have found flaws in the Bluetooth Core Specification and Mesh Profile Specification that allow impersonation attacks and AuthValue disclosures.

The two specifications define the technical and policy requirements for devices that want to operate over Bluetooth connections.

The Bluetooth Impersonation Attacks, or BIAS, allow attackers to impersonate a device and to establish a secure connection with a victim without possessing the long-term key shared by the impersonated device and the victim. This bypasses Bluetooth's authentication mechanism.

"The BIAS attacks are the first uncovering issues related to Bluetooth's secure connection establishment authentication procedures, adversarial role switches, and Secure Connections downgrades," the researchers said. "Our attacks are stealthy because the Bluetooth standard does not require to notify end users about the outcome of an authentication procedure, or the lack of mutual authentication."

"To confirm that the BIAS attacks are practical, we successfully conduct them against 31 Bluetooth devices (28 unique Bluetooth chips) from major hardware and software vendors, implementing all the major Bluetooth versions, including Apple, Qualcomm, Intel, Cypress, Broadcom, Samsung, and CSR."

Researchers added that the attacks work even when the victims use Bluetooth's strongest security modes, including SSP and Secure Connections.

Related Resource

Security awareness training strategies for account takeover protection

Why you need an inside-the-perimeter strategy for internal threats

Security awareness training strategies for account takeover protection - whitepaper from MimecastFree download

"Our attacks target the standardized Bluetooth authentication procedure and are therefore effective against any standard-compliant Bluetooth device," the researchers said.

According to a Carnegie Mellon CERT Coordination Center advisory, the Android Open-Source Project (AOSP), Cisco, Cradlepoint, Intel, Microchip Technology, and Red Hat are vendors affected by the security flaws.

The Bluetooth Special Interest Group (SIG), the organization that directs the development of Bluetooth standards, published a security notice about the flaws. It recommended potentially vulnerable implementations restrict the public keys accepted from a remote peer device to disallow a remote peer to present the same public key the local device chose.

"The Bluetooth SIG is also broadly communicating details on this vulnerability and its remedies to our member companies and is encouraging them to rapidly integrate any necessary patches. As always, Bluetooth users should ensure they have installed the latest recommended updates from device and operating system manufacturers," the organization said in a statement.

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

HackerOne employee fired for using position to steal bug bounties
Security

HackerOne employee fired for using position to steal bug bounties

4 Jul 2022
LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Why India wants to become a chipmaking powerhouse
components

Why India wants to become a chipmaking powerhouse

28 Jun 2022