Researchers: Almost every Bluetooth-enabled device vulnerable to new leak

Researchers have discovered a large-scale leak in the Bluetooth protocol. In theory, this allows attackers to listen in on a device from a distance. There are now a few patches available for Apple and Microsoft devices.

The leak, CVE-2019-9506, was discovered by a team of researchers from the Universities of Singapore and Oxford, and the CISPA Center for Information Security in Helmholtz. The researchers call the leak KNOB-attack, an abbreviation of Key Negotiation or Bluetooth. Coordination of the leak was agreed with a number of major manufacturers so that they can now release patches. These include Amazon, Apple, Cisco, Intel and Microsoft. The vulnerability applies to devices using Bluetooth 1.0 through 5.1. According to the researchers, their attack method works on every device they tested with chipsets from Intel, Broadcom, Apple and Qualcomm.

The problem is specifically in the Bluetooth Basic Rate/Enhanced Data Rate Core Configurations. That protocol contains a vulnerability in the encryption key that is exchanged between two Bluetooth devices when they connect to each other. There is no authentication on the protocol that determines how long that encryption key should be. That means an attacker can manipulate that so that a key must be very small, say just one byte. This makes it easy to retrieve a key with a brute force attack. That is not the case everywhere, however. In some devices or chipsets, the makers have set a minimum encryption size of, for example, seven bytes. In that case it is not possible to establish a connection. Once an attacker has taken over a connection, they can use it to eavesdrop or manipulate Bluetooth signals. According to the researchers, this is also possible with devices that have already been connected to each other. In this way they were able to intercept a file that was being sent via Bluetooth. At the same time, the researchers say they don’t fully understand the damage an attacker can do with an attack.

It seems unlikely that an attacker could actively exploit the vulnerability. To do this, an attacker has to be within the relatively small Bluetooth range of a victim anyway. After that, he must have enough time to perform a brute force attack, and both devices must be vulnerable to KNOB. In addition, the attack must be repeated every time the attacker wants to do something. In addition, active sessions cannot be copied.

The researchers provide more details about the method in their paper. In it they write, among other things, how they managed to eavesdrop on a connection between, among other things, a Nexus 5 and a Motorola G3. They also tested the vulnerability on devices with 17 other chips. The tools to exploit the vulnerability have now been made open source. The researchers have coordinated the disclosure with major manufacturers. However, not all manufacturers have indicated that they have fixed that. It is therefore possible that devices are still vulnerable.

The researchers also discussed their results with Bluetooth SIG, the authority that develops the Bluetooth protocol. It has amended the Bluetooth Core Specification so that manufacturers are advised to use a minimum encryption key length of seven octets for BR/EDR connections from now on.