Thursday, February 22, 2024

BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions

Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward and Future Secrecy) attacks. These attacks could enable threat actors to impersonate devices or machine-in-the-middle attacks. 

These attacks have been reported to be at the architectural level and don’t depend on the victim’s hardware and software details, such as chip, stack, version, or security mode.

In addition to this, a new toolkit has also been released, which could be used to perform these attacks and check their effectiveness.

Document
Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

BLUFFS Attacks

According to the reports shared with Cyber Security News, these attacks have been categorized as 

  • A1: Spoofing a LSC Central
  • A2: Spoofing a LSC Peripheral
  • A3: MitM LSC victims
  • A4: Spoofing a SC Central
  • A5: Spoofing a SC Peripheral
  • A6: MitM SC victim
BLUFFS Attacks (Source: EURECOM)
BLUFFS Attacks (Source: EURECOM)

The major root causes were four architectural vulnerabilities in the specification of Bluetooth session establishment. The root causes have been categorized into two, with SK (Session Key) derivation of sessions and other session establishment phases.

Root cause (RC)

RC1 refers to LSC (Legacy Secure Connections) SK diversification being unilateral. RC2 relates to LSC SK diversification not using nonces.

RC3 is associated with LSC SK not being integrity protected, and RC4 refers to no authentication implementation when downgrading SC (Secure Connections) to LSC (Legacy Secure Connections).

According to reports, A1, A2 and A3 are not affected by RC4. However, all of the attacks from A1 to A6 are affected by all the Root Causes (RC1, RC2, RC3, and RC4).

These six BLUFFS attacks were tested on eighteen devices with seventeen different Bluetooth Chips from popular hardware and software vendors in each of them.

These attacks do not require user interaction or compromising of Bluetooth pairing (keys) as they target protocol-level weaknesses in the Bluetooth Standard.

With these attack methods, researchers could compromise a broad set of devices, including laptops, smartphones, headsets, and speakers, with Operating systems like Android, iOS, Linux, Windows, and proprietary OSes.

A complete research paper has been published providing detailed information on these attack techniques, their concepts, and others.

ChipDevice(s)BTvA1A2A3A4A5A6
LSC Victims
Bestechnic BES2300Pixel Buds A-Series5.2
Apple H1AirPods Pro5
Cypress CYW20721Jaybird Vista5
CSR/Qualcomm BC57H687C-GITM-E4Bose SoundLink4.2
Intel Wireless 7265 (rev 59)Thinkpad X1 3rd gen4.2
CSR n/aLogitech BOOM 34.2××
SC Victims
Infineon CYW20819CYW920819EVB-025
Cypress CYW40707Logitech MEGABLAST4.2
Qualcomm Snapdragon 865Mi 10T5.2×××
Apple/USI 339S00761iPhones 12, 135.2×××
Intel AX201Portege X30-C5.2×××
Broadcom BCM4389Pixel 65.2×××
Intel 9460/9560Latitude 54005×××
Qualcomm Snapdragon 835Pixel 25×××
Murata 339S00199iPhone 74.2×××
Qualcomm Snapdragon 821Pixel XL4.2×××
Qualcomm Snapdragon 410Galaxy J54.1×××
Results of Evaluation (Source: EURECOM)

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Website

Latest articles

Leak of China’s Hacking Documentation Stunned Researchers

In a startling revelation that has sent shockwaves through the cybersecurity community, a massive...

Apex Code Vulnerabilities Let Hackers Steal Salesforce Data

Hackers target Apex code vulnerabilities in Salesforce to exploit security weaknesses, gain unauthorized access...

Beware of New AsukaStealer Steal Browser Passwords & Desktop Screens

An updated version of the ObserverStealer known as AsukaStealer was observed to be advertised as...

US to Pay $15M for Info About Lockbit Ransomware Operator Data

In a significant move against cybercrime, the U.S. government has announced a bounty of...

Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use,...

Swiggy Account Hacked, Hackers Placed Orders Worth Rs 97,000

In a startling incident underscoring the growing menace of cybercrime, a woman's Swiggy account...

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles