Categories: Bluetooth

New Bluetooth Vulnerability Allow Hackers to Intercept The Encrypted Traffic & Spy on the Devices

Researchers discovered a severe privilege escalation vulnerability in Bluetooth let unauthenticated attackers intercept and monitor the encryption traffic between two paired devices.

The bug discovered in Bluetooth BR/EDR encryption connection, in which an attacker reduces the encryption key length and perform a brute-force attack to decrypt communications between the devices.

Bluetooth BR/EDR ( Basic Rate/Enhanced Data Rate) is used for low-power short-range communications, and the encrypted connection can be established by pairings the two Bluetooth devices and establish a link key that is used to generate the encryption key.

Here the Key Negotiation of Bluetooth (KNOB) attack comes into play that an attacker can force two Bluetooth devices to use as low as 1 byte of entropy and reduce the key length.

Researchers from CISPA (Center for IT-Security, Privacy and Accountability) identified that, even in cases where a Bluetooth specification did mandate a minimum key length, Bluetooth products exist in the field that may not currently perform the required step to verify the negotiated encryption key meets the minimum length.

In this way, an attacker reduces the encryption key length and initiate a brute force attack to crack the key and intercept the traffic and monitor the paired device communication.

Certain Requirements Needs to Intercept the Traffic

In order to perform the successful attack, some of the following requirements need to meet even if the attacker gains the encryption key.

1. Both targetted devices should be vulnerable to the Key Negotiation of Bluetooth (KNOB) attack.

2. Attacking device would need to be within wireless range of two vulnerable Bluetooth devices.

3. At the same time, two vulnerable Bluetooth devices must be establishing a BR/EDR connection.

4. One of the paired devices did not have the vulnerability then the attack is not possible.

5. Within a narrow time window, Attacking device would require to manipulate the traffic, retransmit key length negotiation messages between the two devices, needs to blocking transmissions from both devices.

6. Even if the attacker Shorten the encryption key length, he needs to perform a brute force attack to crack the encryption key that would allow decrypting all of the traffic between the devices during that session.

“There is no evidence found that the vulnerability being exploited and, to remedy the vulnerability, the Bluetooth SIG has updated the Bluetooth Core Specification to recommend a minimum encryption key length of 7 octets for BR/EDR connections,” Bluetooth said.

You can also refer to this whitepaper which elaborates the complete research of Key Negotiation Of Bluetooth (KNOB) attack.

Bluetooth BR/EDR Core v5.1 and earlier is vulnerable and the Top-order vendors including Google, Microsoft, and Apple has been released a patch for Vulnerability – Android, WindowsmacOS.

Sponsored:  – Manage all the Endpoint networks from a single Console.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

BLEEDINGBIT – Two Bluetooth Chip-level Vulnerabilities Affected Millions of Enterprise Wi-Fi Access Point Devices

Hackers Nearby can Hijack Bluetooth Titan Security Keys – Google Replacing it for Free

CarsBlues Bluetooth Hack Allows Hackers to Access Text Messages, Call Logs and More

Critical BlueBorne Vulnerability Puts More Than 5 Billion Bluetooth Enabled Devices Under Attack

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago