New Bluetooth Vulnerability Allow Hackers to Intercept The Encrypted Traffic & Spy on the Devices
Researchers discovered a severe privilege escalation vulnerability in Bluetooth let unauthenticated attackers intercept and monitor the encryption traffic between two paired devices.
The bug discovered in Bluetooth BR/EDR encryption connection, in which an attacker reduces the encryption key length and perform a brute-force attack to decrypt communications between the devices.
Bluetooth BR/EDR ( Basic Rate/Enhanced Data Rate) is used for low-power short-range communications, and the encrypted connection can be established by pairings the two Bluetooth devices and establish a link key that is used to generate the encryption key.
Here the Key Negotiation of Bluetooth (KNOB) attack comes into play that an attacker can force two Bluetooth devices to use as low as 1 byte of entropy and reduce the key length.
Researchers from CISPA (Center for IT-Security, Privacy and Accountability) identified that, even in cases where a Bluetooth specification did mandate a minimum key length, Bluetooth products exist in the field that may not currently perform the required step to verify the negotiated encryption key meets the minimum length.
In this way, an attacker reduces the encryption key length and initiate a brute force attack to crack the key and intercept the traffic and monitor the paired device communication.
In order to perform the successful attack, some of the following requirements need to meet even if the attacker gains the encryption key.
1. Both targetted devices should be vulnerable to the Key Negotiation of Bluetooth (KNOB) attack.
2. Attacking device would need to be within wireless range of two vulnerable Bluetooth devices.
3. At the same time, two vulnerable Bluetooth devices must be establishing a BR/EDR connection.
4. One of the paired devices did not have the vulnerability then the attack is not possible.
5. Within a narrow time window, Attacking device would require to manipulate the traffic, retransmit key length negotiation messages between the two devices, needs to blocking transmissions from both devices.
6. Even if the attacker Shorten the encryption key length, he needs to perform a brute force attack to crack the encryption key that would allow decrypting all of the traffic between the devices during that session.
“There is no evidence found that the vulnerability being exploited and, to remedy the vulnerability, the Bluetooth SIG has updated the Bluetooth Core Specification to recommend a minimum encryption key length of 7 octets for BR/EDR connections,” Bluetooth said.
You can also refer to this whitepaper which elaborates the complete research of Key Negotiation Of Bluetooth (KNOB) attack.
Bluetooth BR/EDR Core v5.1 and earlier is vulnerable and the Top-order vendors including Google, Microsoft, and Apple has been released a patch for Vulnerability – Android, Windows, macOS.
This post New Bluetooth Vulnerability Allow Hackers to Intercept The Encrypted Traffic & Spy on the Devices originally appeared on GB Hackers.
