BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions

Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward and Future Secrecy) attacks. These attacks could enable threat actors to impersonate devices or machine-in-the-middle attacks. 

These attacks have been reported to be at the architectural level and don’t depend on the victim’s hardware and software details, such as chip, stack, version, or security mode.

In addition to this, a new toolkit has also been released, which could be used to perform these attacks and check their effectiveness.

Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

Try StorageGuard for Free

BLUFFS Attacks

According to the reports shared with Cyber Security News, these attacks have been categorized as 

• A1: Spoofing a LSC Central
• A2: Spoofing a LSC Peripheral
• A3: MitM LSC victims
• A4: Spoofing a SC Central
• A5: Spoofing a SC Peripheral
• A6: MitM SC victim

The major root causes were four architectural vulnerabilities in the specification of Bluetooth session establishment. The root causes have been categorized into two, with SK (Session Key) derivation of sessions and other session establishment phases.

Root cause (RC)

RC1 refers to LSC (Legacy Secure Connections) SK diversification being unilateral. RC2 relates to LSC SK diversification not using nonces.

RC3 is associated with LSC SK not being integrity protected, and RC4 refers to no authentication implementation when downgrading SC (Secure Connections) to LSC (Legacy Secure Connections).

According to reports, A1, A2 and A3 are not affected by RC4. However, all of the attacks from A1 to A6 are affected by all the Root Causes (RC1, RC2, RC3, and RC4).

These six BLUFFS attacks were tested on eighteen devices with seventeen different Bluetooth Chips from popular hardware and software vendors in each of them.

These attacks do not require user interaction or compromising of Bluetooth pairing (keys) as they target protocol-level weaknesses in the Bluetooth Standard.

With these attack methods, researchers could compromise a broad set of devices, including laptops, smartphones, headsets, and speakers, with Operating systems like Android, iOS, Linux, Windows, and proprietary OSes.

A complete research paper has been published providing detailed information on these attack techniques, their concepts, and others.

Chip	Device(s)	BTv	A1	A2	A3	A4	A5	A6
LSC Victims
Bestechnic BES2300	Pixel Buds A-Series	5.2	✓	✓	✓	✓	✓	✓
Apple H1	AirPods Pro	5	✓	✓	✓	✓	✓	✓
Cypress CYW20721	Jaybird Vista	5	✓	✓	✓	✓	✓	✓
CSR/Qualcomm BC57H687C-GITM-E4	Bose SoundLink	4.2	✓	✓	✓	✓	✓	✓
Intel Wireless 7265 (rev 59)	Thinkpad X1 3rd gen	4.2	✓	✓	✓	✓	✓	✓
CSR n/a	Logitech BOOM 3	4.2	✓	×	✓	✓	×	✓
SC Victims
Infineon CYW20819	CYW920819EVB-02	5	✓	✓	✓	✓	✓	✓
Cypress CYW40707	Logitech MEGABLAST	4.2	✓	✓	✓	✓	✓	✓
Qualcomm Snapdragon 865	Mi 10T	5.2	✓	✓	✓	×	×	×
Apple/USI 339S00761	iPhones 12, 13	5.2	✓	✓	✓	×	×	×
Intel AX201	Portege X30-C	5.2	✓	✓	✓	×	×	×
Broadcom BCM4389	Pixel 6	5.2	✓	✓	✓	×	×	×
Intel 9460/9560	Latitude 5400	5	✓	✓	✓	×	×	×
Qualcomm Snapdragon 835	Pixel 2	5	✓	✓	✓	×	×	×
Murata 339S00199	iPhone 7	4.2	✓	✓	✓	×	×	×
Qualcomm Snapdragon 821	Pixel XL	4.2	✓	✓	✓	×	×	×
Qualcomm Snapdragon 410	Galaxy J5	4.1	✓	✓	✓	×	×	×

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.