Friday, December 8, 2023

New Bluetooth Vulnerability Allow Hackers to Intercept The Encrypted Traffic & Spy on the Devices

Researchers discovered a severe privilege escalation vulnerability in Bluetooth let unauthenticated attackers intercept and monitor the encryption traffic between two paired devices.

The bug discovered in Bluetooth BR/EDR encryption connection, in which an attacker reduces the encryption key length and perform a brute-force attack to decrypt communications between the devices.

Bluetooth BR/EDR ( Basic Rate/Enhanced Data Rate) is used for low-power short-range communications, and the encrypted connection can be established by pairings the two Bluetooth devices and establish a link key that is used to generate the encryption key.

Here the Key Negotiation of Bluetooth (KNOB) attack comes into play that an attacker can force two Bluetooth devices to use as low as 1 byte of entropy and reduce the key length.

Researchers from CISPA (Center for IT-Security, Privacy and Accountability) identified that, even in cases where a Bluetooth specification did mandate a minimum key length, Bluetooth products exist in the field that may not currently perform the required step to verify the negotiated encryption key meets the minimum length.

In this way, an attacker reduces the encryption key length and initiate a brute force attack to crack the key and intercept the traffic and monitor the paired device communication.

Certain Requirements Needs to Intercept the Traffic

In order to perform the successful attack, some of the following requirements need to meet even if the attacker gains the encryption key.

1. Both targetted devices should be vulnerable to the Key Negotiation of Bluetooth (KNOB) attack.

2. Attacking device would need to be within wireless range of two vulnerable Bluetooth devices.

3. At the same time, two vulnerable Bluetooth devices must be establishing a BR/EDR connection.

4. One of the paired devices did not have the vulnerability then the attack is not possible.

5. Within a narrow time window, Attacking device would require to manipulate the traffic, retransmit key length negotiation messages between the two devices, needs to blocking transmissions from both devices.

6. Even if the attacker Shorten the encryption key length, he needs to perform a brute force attack to crack the encryption key that would allow decrypting all of the traffic between the devices during that session.

“There is no evidence found that the vulnerability being exploited and, to remedy the vulnerability, the Bluetooth SIG has updated the Bluetooth Core Specification to recommend a minimum encryption key length of 7 octets for BR/EDR connections,” Bluetooth said.

You can also refer to this whitepaper which elaborates the complete research of Key Negotiation Of Bluetooth (KNOB) attack.

Bluetooth BR/EDR Core v5.1 and earlier is vulnerable and the Top-order vendors including Google, Microsoft, and Apple has been released a patch for Vulnerability – Android, WindowsmacOS.

Sponsored: Best Practices to Strengthen Cyber Security – Manage all the Endpoint networks from a single Console.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices

Hackers Nearby can Hijack Bluetooth Titan Security Keys – Google Replacing it for Free

CarsBlues Bluetooth Hack Allows Hackers to Access Text Messages, Call Logs and More

Critical BlueBorne Vulnerability Puts More Than 5 Billion Bluetooth Enabled Devices Under Attack


Latest articles

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

SLAM Attack Gets Root Password Hash in 30 Seconds

Spectre is a class of speculative execution vulnerabilities in microprocessors that can allow threat...

Akira Ransomware Exploiting Zero-day Flaws For Organization Network Access

The Akira ransomware group, which first appeared in March 2023, has been identified as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles