When we do defcon, Bluetooth is one of the easiest protocols to take control of. It’s funny. It’s also easy to spoof, easy to mess with, and generally very insecure.
I’m curious, what about Bluetooth makes it insecure? Is it that vendors create insecure implementations, like Android, or is it a human issue like connecting to things by default? I recall the Bluetooth spec being unbelievably complex and verbose, which obviously increases risk and makes it harder to audit, but it doesn’t get many updates, and I don’t recall seeing many issues with the spec itself. I mean it’s not like it’s fixing a CVE every quarter like with netty packages.
Its more complex than I can talk about here in any kind of depth, but it comes down to it being a very old protocol. It has known security issues that are just not fixed as it would break backwards compatibility with a lot of devices. So the same issues that were chosen to not be fixed are still out there. You can, with very little effort, take control of just about any Bluetooth device(or partial). Or at least knock it out if commission.
Bluetooth has one of the largest network stacks. It’s bigger than Wifi. This means some parts of the stack probably aren’t tested and may have bugs or vulnerabilities. It has duplicate functionality in it. This opens up the possibility that flaws in how different parts interact could lead to vulnerabilities or exploits.
A number of years ago some security researchers did an analysis of the Windows and Linux stacks. They found multiple exploitable vulnerabilities in both stacks. They called their attack blue borne, but it was really a series of attacks that could be used depending on which OS you wanted to target. Some what ironically, Linux was more vulnerable because the Linux kernel implemented more of the protocol than Windows.
The Google Nearby feature thing (Google’s coming version of Apple Air Tags) will require a constant background Bluetooth scanner to listen for the tags.
My opinion: that stays off. Looking for your lost phone, luggage, or ex-wife? Im not going to help you if i dont know you. Buy a new item, take better care of it.
Any way to turn that off? Bluetooth is very insecure.
If you read the article they say there’s a toggle to enable/disable auto Bluetooth on.
In what ways is having bluetooth on but not doing anything insecure?
I mean it was not too long ago there was a bug which could lead to an unauthenticated RCE against Bluetooth on Android.
https://nvd.nist.gov/vuln/detail/CVE-2022-20345
So yea, reducing surface area of attack when a feature is not needed is kinda important.
When we do defcon, Bluetooth is one of the easiest protocols to take control of. It’s funny. It’s also easy to spoof, easy to mess with, and generally very insecure.
I’m curious, what about Bluetooth makes it insecure? Is it that vendors create insecure implementations, like Android, or is it a human issue like connecting to things by default? I recall the Bluetooth spec being unbelievably complex and verbose, which obviously increases risk and makes it harder to audit, but it doesn’t get many updates, and I don’t recall seeing many issues with the spec itself. I mean it’s not like it’s fixing a CVE every quarter like with netty packages.
Its more complex than I can talk about here in any kind of depth, but it comes down to it being a very old protocol. It has known security issues that are just not fixed as it would break backwards compatibility with a lot of devices. So the same issues that were chosen to not be fixed are still out there. You can, with very little effort, take control of just about any Bluetooth device(or partial). Or at least knock it out if commission.
There’s a ton of Honeypot projects. Just the first Google result: https://github.com/andrewmichaelsmith/bluepot
tracking!
People lock their door when lock picks and axes exist. Making criminals work harder to access your belongings is pretty important in a lot of aspects.
Bluetooth has one of the largest network stacks. It’s bigger than Wifi. This means some parts of the stack probably aren’t tested and may have bugs or vulnerabilities. It has duplicate functionality in it. This opens up the possibility that flaws in how different parts interact could lead to vulnerabilities or exploits.
A number of years ago some security researchers did an analysis of the Windows and Linux stacks. They found multiple exploitable vulnerabilities in both stacks. They called their attack blue borne, but it was really a series of attacks that could be used depending on which OS you wanted to target. Some what ironically, Linux was more vulnerable because the Linux kernel implemented more of the protocol than Windows.
What? The kernel only implements HCI - a way to talk to hardware
The Bluetooth stack and its protocols are implemented in BlueZ or on Android in Gabeldorsche
Yeeeaaah, that makes more sense. 😅 That would be a giant gaping vulnerability if everything was in kernel space.
The Google Nearby feature thing (Google’s coming version of Apple Air Tags) will require a constant background Bluetooth scanner to listen for the tags.
My opinion: that stays off. Looking for your lost phone, luggage, or ex-wife? Im not going to help you if i dont know you. Buy a new item, take better care of it.