major Bluetooth security issue: BlueBorne - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: September 13, 2017, 10:35:50 am
content: The article:https://www.bleepingcomputer.com/news/security/blueborne-vulnerabilities-impact-over-5-billion-bluetooth-enabled-devices/And the whitepaper with all the details:http://go.armis.com/hubfs/BlueBorne%20Technical%20White%20Paper.pdfIf you got any project/product with Bluetooth you might want the check the Bluetooth stack or check for updates.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: September 13, 2017, 10:22:04 pm
content: And the cause? Bloat.Quote

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 13, 2017, 10:33:49 pm
content: Even though the potential consequences are horrible, I'm really glad that hardware and firmware security is finally gaining some momentum. For too long has the focus been on the main OS for mobile devices, with all the dirty secrets below the surface completely ignored.

author: Neilm
author_rank: Super Contributor
timestamp: September 14, 2017, 06:37:04 pm
content: Given that even reasonably low spec cars come equiped with Bluetooth wired into the entertainment systems, I wonder if the car manufacturers will be issuing updates any time soon.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: September 14, 2017, 07:16:18 pm
content: Quote from: Neilm on September 14, 2017, 06:37:04 pmIf they do, will the updates be secure?

author: jnz
author_rank: Frequent Contributor
timestamp: September 14, 2017, 09:16:59 pm
content: I'm a little interested in how they're (magically) going from BT chipset to admin privileges and ruuning code on the CPU and OS in those examples - anyone?

author: julian1
author_rank: Frequent Contributor
timestamp: September 14, 2017, 09:30:59 pm
content: With a buffer overflow in the bluetooth kernel module, you can execute code to modify kernel data structures.

author: cdev
author_rank: Super Contributor
timestamp: September 14, 2017, 10:05:54 pm
content: I'm really glad that all the governments of the world are so conscientious about security..I am sure that they will share any back-doors they find, equally.

author: Vtile
author_rank: Super Contributor
timestamp: September 14, 2017, 10:12:53 pm
content: #internetofshit

author: nidlaX
author_rank: Frequent Contributor
timestamp: September 14, 2017, 11:27:33 pm
content: Quote from: jnz on September 14, 2017, 09:16:59 pmRead their technical white paper, each exploit is discussed in detail with offending code snippets from the OS stack source / disassembled stack binaries.

author: cdev
author_rank: Super Contributor
timestamp: September 15, 2017, 02:26:50 am
content: Either those three letter agencies are really smart, or people aren't.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: September 15, 2017, 04:27:00 pm
content: Quote from: Vtile on September 14, 2017, 10:12:53 pmQFT.IOT, wireless this, wireless that, scripting languages everywhere - and security is always an afterthought. I cringe when someone talks about connecting their home appliances to the internet.Quote from: cdevMygovernment certainly is conscientious about security, but sharing 'backdoors' is not their responsibility.Privatecompanies are producing insecure devices and selling them to unsuspecting consumers, and most cybercrime is committed by miscreantindividualswho are looking to steal or trash your stuff. If you want to prevent it thenyouhave to be conscientious about security.

author: jnz
author_rank: Frequent Contributor
timestamp: September 19, 2017, 03:57:04 pm
content: Quote from: julian1 on September 14, 2017, 09:30:59 pmQuote from: nidlaX on September 14, 2017, 11:27:33 pmI read the technical paper, well, skimmed to the best of my attention span; Bluetooth is tough for the very reasons this hack exists it doesn't use a separate layer like TCPIP it just has all the packing and protocols built in - super dumb, kinda hard to follow. Anyhow, I am STILL not seeing how BT data is becoming OS level instructions. He talks about how the linux kernel is particularly susepible to this exploit because you will have some awareness of the kernel calls and structures.I guess my issue is I'm coming from Bluetooth modules that run their own stacks and the host CPU just interfaces, almost never applications where the host CPU is running the BT stack itself. That said... since a lot of the hack involves L2CAP, and BLE uses the same L2CAP as BT, I wonder if low energy exploits may be coming.

author: madires
author_rank: Super Contributor
timestamp: September 19, 2017, 05:32:44 pm
content: It boils down to a classic buffer overflow. If you're using BT modules an attack would just harm the module, but that could also have an impact on the communication between module and MCU. I'd check if the modules are affected by BlueBorne and upgrade the firmware.

author: nidlaX
author_rank: Frequent Contributor
timestamp: September 19, 2017, 06:43:34 pm
content: Quote from: jnz on September 19, 2017, 03:57:04 pmThese hacks are specific to software stacks run by the computer's OS as drivers. They don't apply to your Bluetooth over UART dongles or whatever.That being said, the overall structure of the attacks in question are malformed or otherwise unanticipated packets sent during discovery and link negotiation. The driver stack code does not anticipate the structure and/or length of these packets, leading to buffer overflows. Overall, it's a result of the system designers not anticipating the ease of sending requests to "hidden" nodes.I'm not an expert, so someone can come put me in my place.

author: tszaboo
author_rank: Super Contributor
timestamp: September 20, 2017, 09:37:20 am
content: Quote from: Neilm on September 14, 2017, 06:37:04 pmAnd what would they do, if they take over? Play Genesis "I know what I like" on the stereo?

author: CM800
author_rank: Frequent Contributor
timestamp: September 20, 2017, 09:53:18 am
content: Quote from: NANDBlog on September 20, 2017, 09:37:20 amSuddenly play multiple frequencies that the ear is most sensitive too, at max volume, (and if it can possibly detect) right at the point when the car is going fast, weather conditions are the worst (weather info), and the car is surrounded with other cars (distance sensors)

author: tszaboo
author_rank: Super Contributor
timestamp: September 20, 2017, 10:16:58 am
content: Quote from: CM800 on September 20, 2017, 09:53:18 amOK, so you need to have someone within some 30, for around half a minute drive next to you, with the attempt to kill you. Luckily today nobody tried assassinating me yet today. Also, my car doesnt have BLE.And before you ask, no, the car radio doesnt get the radar info, doesnt get the weather info. In fact, I was very suprised how little info I get on the car's CAN bus. I know, in hacker movies everything is hackable, which is connected together with a wire, but that isnt real life.

author: madires
author_rank: Super Contributor
timestamp: September 20, 2017, 10:18:00 am
content: Quote from: NANDBlog on September 20, 2017, 09:37:20 amIf you're lucky you will be just rick-rolled

author: cdev
author_rank: Super Contributor
timestamp: September 28, 2017, 02:07:52 pm
content: The media hasn't covered this story as it should, as far as I can tell.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: September 28, 2017, 05:56:09 pm
content: Quote from: NANDBlog on September 20, 2017, 10:16:58 amMaybe not so close...Host XR3 Dongle (a.k.a. extend your bluetooth range)QuoteQuoteWith modern devices having field-updatable firmware I wouldn't be so sure about that.

author: MT
author_rank: Super Contributor
timestamp: September 28, 2017, 11:38:06 pm
content: MQTT protocol that makes you cringe!Slogan:Its one thing when you spam your neighbors fridge, but a very different thing when billions of fridges spamming you.https://www.wired.com/2013/07/shodan-search-engine/