New Bluetooth Bug With Remote Access Vulnerabilities Surfaces, Fix Deployed

HIGHLIGHTS

• The bug has affected both Bluetooth and Bluetooth LE's standards
• Drivers from Apple, Broadcom, Intel, and Qualcomm have been affected
• Software and firmware updates will roll out in the coming weeks

A new cryptographic bug has come to light that is claimed to affect 

the Bluetooth implementations of multiple operating system drivers manufactured by big 

corporations including Apple, Broadcom, Intel, Qualcomm, among others. A report suggests 

that this bug has occurred due to an insufficient validation of encryption parameters on 

secure Bluetooth connections. Tracked as CVE-2018-5383, this Bluetooth bug seems to 

have affected both the "Secure Simple Pairing" and "Secure Connections" processes of 

Bluetooth standard and Bluetooth LE, respectively.


As per a report by Bleeping Computer, Israeli scientists Lior Neumann and Eli Biham, from 

the Israel Institute of Technology,have discovered the CVE-2018-5383 bug. In a blog post on 

Monday, Bluetooth Special Interest Group (SIG) acknowledged the bug and stated that there 

is a possibility that some vendors may have developed Bluetooth-compatible products that 

do not perform public key validation during the pairing procedure. This can potentially give 

remote access to attackers who are within wireless range of two such vulnerable devices.


"The attacking device would need to intercept the public key exchange by blocking each 

transmission, sending an acknowledgement to the sending device, and then injecting the 

malicious packet to the receiving device within a narrow time window.If only one device had 

the vulnerability, the attack would not be successful," explained the blog post


As a solution, the Bluetooth SIG has updated its Bluetooth specification to now require all 

public keys to be validated as part of the default security procedures, Adding to that,the SIG 

has also added testing for this vulnerability to its Bluetooth Qualification Program.


In a post by CERT, Microsoft is claimed to not have been affected by the Bluetooth bug. 

Additionally, this post also goes on to state the reason for this vulnerability.


"Bluetooth utilizes a device pairing mechanism based on elliptic-curve Diffie-Hellman 

(ECDH) key exchange to allow encrypted communication between devices. The ECDH key 

pair consists of a private and a public key, and the public keys are exchanged to produce a 

shared pairing key," it notes. "The devices must also agree on the elliptic curve parameters 

being used. Previous work on the "Invalid Curve Attack" showed that the ECDH parameters 

are not always validated before being used in computing the resulted shared key, which 

reduces attacker effort to obtain the private key of the device under attack if the 

implementation does not validate all of the parameters before computing the shared key."


According to Bleeping Computer, Apple, Broadcom, Intel, and Qualcomm have already 

issued software fixes for this vulnerability. Additionally, CERT was unable to detect whether 

devices running Google'ssoftware, AOSP, and Linux were affected or not. Software updates 

on laptops, desktops, and smartphones, and firmware updates on IoT devices are expected 

in the coming weeks