A large number of vendors that have incorporated Bluetooth interfaces with their gadgets without requiring key approval are issuing fixes for their products.
Analysts at the Israel Institute of Technology have found a cryptography-related security weakness (CVE-2018-5383) in the Bluetooth connectivity between devices, concerning two related Bluetooth features: Secure Simple Pairing and LE Secure Connections.
Basically, the Bluetooth spec enabled sellers to quit executing open key validation when devices utilize the two fatures, opening the way to a man-in-the-middle attack. Without the authentification set up, the weakness becomes possibly dangerous factor: An attacker with physical proximity (30 meters) can get unapproved access to to device, sniff activity and send fake pairing messages between two defenseless Bluetooth devices.
“It is possible that some vendors may have developed Bluetooth products that support those features but do not perform public key validation during the pairing procedure,” explained the Bluetooth Special Interest Group (SIG) in a short post on the issue, “To remedy the vulnerability, the Bluetooth SIG has now updated the Bluetooth specification to require products to validate any public key received as part of public key-based security procedures.
In addition, the Bluetooth SIG has added testing for this vulnerability within our Bluetooth Qualification Program.”
Diving deeper into the exploit, the problem exists in Bluetooth’s use of a device-pairing mechanism based on elliptic-curve Diffie-Hellman (ECDH) key exchange, to enable encrypted communication between bluetooth devices.
Bluetooth noted that there’s no evidence of an usable exploit in the real world, and explained that a successful exploitation would be very challenging:
“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure. The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”
