Slashdot Mirror
Bluetooth Security Flaw Could Let Nearby Attacker Grab Your Private Data (zdnet.com)
A recently discovered bug in many Bluetooth firmware and OS drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices. Researchers at the Israel Institute of Technology discovered the flaw, which was flagged today by Carnegie Mellon University CERT. It affects Bluetooth's Secure Simple Pairing and Low Energy Secure Connections. ZDNet reports: As the CERT notification explains, the vulnerability is caused by some vendors' Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel. This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and "passively intercept and decrypt all device messages, and/or forge and inject malicious messages." Thankfully, patches are on the way. "Intel recommended users upgrade to the latest support driver and to check with vendors if they have provided one in their respective updates," reports ZDNet. "Dell has released a new driver for the Qualcomm driver it uses while Lenovo's update is for the flaw in Intel software. LG and Huawei have referenced fixes for CVE-2018-5383 in their respective July updates for mobile devices." It is not yet known if Android, Google, or the Linux kernel are affected. Apple has released a patch for the flaw earlier this month.
My BT mouse regularly loses connection with my computer sitting 1 meter away. If you can intercept it at 30 meters, you deserve to get all the private data I'm leaking ... about the position of the cursor on my screen.
Apple has already introduced a fix for the bug on its devices (in macOS High Sierra 10.13.5/10.13.6, iOS 11.4, tvOS 11.4, and watchOS 4.3.1), so iOS and Mac users do not need to worry. Intel, Broadcom, and Qualcomm have also introduced fixes, while Microsoft says its devices are not affected.
... take showers.
It little behooves the best of us to comment on the rest of us.
Bluetooth never worked well, it seemed like the industry had too many voices when it was being developed.
Bluetooth always disconnects, reconnection is a pain in the ass, connection or disconnection or pairing is entirely random. Bluetooth is was and will remain completely unfit for the consumer market, it was half baked and should not have been released. How people aren't launching a ton of civil suits for lemon laws I have no idea.
Oh it has security flaws ontop of low battery life and connectivity issues? Well color me shocked.
I find anything with a micro USB dongle usually has a AA battery life time of 8+ months and never any connectivity issues. Bluetooth was supposed to work like this but in practice it sucks batteries dry like a vampire and forgets everything like an old man with dementia.
is the wise option as it always was. Who would open their devices to any stranger with wireless skills?
Domestic spying is now "Benign Information Gathering"
Remember the car whisperer guys with their "long distance snarf"? Not the only ones to do that either. No reason why you couldn't do that here.
and so my phone conversations will be secured when if ever?
since the first time I've seen this headline, about 15 years ago.
I talk with my phone to my head, and I only watch "sensitive" shit with cabled headphones.
TFA and the first paragraph of the CERT advisory it quotes talk about exposing the "private key".
I'm not clear whether this is a misspeak, with the vunerable key being the session key, or if the parameter checking failure actually jeopardizes the private key of the attacked system.
The latter is a MUCH bigger problem. If its only the session key that may be exposed, fixing the bug is all you need (unless the attacker was able to get into a service that let him view or alter the private key of the affected devices). If the private key was exposed and obtained, devices will need to be re-keyed.
Does anyone looking into this have information to distinguish the two cases?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way