BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions

Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward and Future Secrecy) attacks. These attacks could enable threat actors to impersonate devices or machine-in-the-middle attacks. 

These attacks have been reported to be at the architectural level and don’t depend on the victim’s hardware and software details, such as chip, stack, version, or security mode.

In addition to this, a new toolkit has also been released, which could be used to perform these attacks and check their effectiveness.

- Advertisement -

BLUFFS Attacks

According to the reports shared with Cyber Security News, these attacks have been categorized as 

• A1: Spoofing a LSC Central
• A2: Spoofing a LSC Peripheral
• A3: MitM LSC victims
• A4: Spoofing a SC Central
• A5: Spoofing a SC Peripheral
• A6: MitM SC victim

The major root causes were four architectural vulnerabilities in the specification of Bluetooth session establishment. The root causes have been categorized into two, with SK (Session Key) derivation of sessions and other session establishment phases.

Root cause (RC)

RC1 refers to LSC (Legacy Secure Connections) SK diversification being unilateral. RC2 relates to LSC SK diversification not using nonces.

RC3 is associated with LSC SK not being integrity protected, and RC4 refers to no authentication implementation when downgrading SC (Secure Connections) to LSC (Legacy Secure Connections).

According to reports, A1, A2 and A3 are not affected by RC4. However, all of the attacks from A1 to A6 are affected by all the Root Causes (RC1, RC2, RC3, and RC4).

These six BLUFFS attacks were tested on eighteen devices with seventeen different Bluetooth Chips from popular hardware and software vendors in each of them.

These attacks do not require user interaction or compromising of Bluetooth pairing (keys) as they target protocol-level weaknesses in the Bluetooth Standard.

With these attack methods, researchers could compromise a broad set of devices, including laptops, smartphones, headsets, and speakers, with Operating systems like Android, iOS, Linux, Windows, and proprietary OSes.

A complete research paper has been published providing detailed information on these attack techniques, their concepts, and others.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.