Slashdot Mirror

A recently discovered bug in many Bluetooth firmware and OS drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices. Researchers at the Israel Institute of Technology discovered the flaw, which was flagged today by Carnegie Mellon University CERT. It affects Bluetooth's Secure Simple Pairing and Low Energy Secure Connections. ZDNet reports: As the CERT notification explains, the vulnerability is caused by some vendors' Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel. This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and "passively intercept and decrypt all device messages, and/or forge and inject malicious messages." Thankfully, patches are on the way. "Intel recommended users upgrade to the latest support driver and to check with vendors if they have provided one in their respective updates," reports ZDNet. "Dell has released a new driver for the Qualcomm driver it uses while Lenovo's update is for the flaw in Intel software. LG and Huawei have referenced fixes for CVE-2018-5383 in their respective July updates for mobile devices." It is not yet known if Android, Google, or the Linux kernel are affected. Apple has released a patch for the flaw earlier this month.

Daath writes "It just came to my attention, that LG Electronics announced a SmartPhone with 192MB memory and a built in 1.1 Mpixel CCD camera. It's a slide-down type phone, running on a 400MHz Intel X-Scale processor with a 2.8" 262K color TFT LCD. It runs MS PocketPC 2003. Personally I think it blows the SE P900 away. Ok, time to wipe the drool off the keyboard! ;)"

Daath writes "It just came to my attention, that LG Electronics announced a SmartPhone with 192MB memory and a built in 1.1 Mpixel CCD camera. It's a slide-down type phone, running on a 400MHz Intel X-Scale processor with a 2.8" 262K color TFT LCD. It runs MS PocketPC 2003. Personally I think it blows the SE P900 away. Ok, time to wipe the drool off the keyboard! ;)"

securitas writes "The New York Times is carrying a Reuters story about Linux as the software of choice for consumer electronics. At the world's largest consumer electronics show, the IFA trade fair 'the first Linux products are already on show and more will come soon, companies said.' The reason? Linux is freely available, widely embraced and profit margins in the consumer electronics business are one or two percent at best. The math is simple. The industry push comes from the members of the Consumer Electronics Linux Forum (CELF), that includes Sony, Philips, Matsushita/Panasonic, Hitachi, Sharp, Samsung, NEC, IBM, LG, Thomson/RCA and Toshiba. The CELF was previously discussed on Slashdot. Mirrors at Silicon.com and CNet News."