Nowadays, there are various Bluetooth headsets, Bluetooth bracelets, car Bluetooth and so on. Since the advent of Bluetooth technology, it has not only solved many data transmission problems, but also opened the door to wireless life, and has been used to connect by various smart devices. Nevertheless, while this technology brings convenience to our lives, it also brings some security risks. According to researchers from Boston University, vulnerabilities in the Bluetooth communication protocol on smart bracelets and other Bluetooth devices can lead to the breach of sensitive personal information and allow third parties to track the location of the device.
Due to a newly discovered vulnerability in the Bluetooth standard, hackers may weaken the encryption of Bluetooth devices and then spy on communications or take over the device. Instead of directly cracking the encryption, this vulnerability allows hackers to force a pair of Bluetooth devices to use weaker encryption from the beginning, which makes it easier to crack. Each time two Bluetooth devices are connected, they will create a new encryption key. If an attacker intervenes in the setup process, they may trick the two devices to use relatively few characters to generate the encryption key. The attacker must still perform a brute force attack on one of the devices to find out the exact password.
Researchers named this vulnerability as Key Negotiation Of Bluetooth (KNOB) attack and offered some suggestions to vendors and users:
Vendors should:
- Add the verification for pairing key when pairing
- Use mutual authentication to ensure connection security when connecting
- Choose highly secured service providers
- Back up user information in a timely manner
- Encrypt important files for transmission
- Use encrypted cloud services
- Take passwords seriously
- Strengthen data security audits in production environments
- Use high-security Bluetooth system chips and modules on the hardware to minimize the impact of technical vulnerabilities on users.
Users should:
- Choose products made by regular large manufacturers when choosing products
- Turn off the Bluetooth function when not in use
- Update the system software version in time to eliminate its vulnerabilities
- Reduce the frequency of Bluetooth pairings
- Choose to pair in a safe environment, so that others do not see the pairing password
- Not to connect or pair untrusted devices.
LIFARS’ Incident Response Retainer Solution is different from what you may have been accustomed to. We eliminate uncertainty when responding to a breach and provide a highly skilled elite Incident Response team at your service with business effective SLA-based response times, decades of experience and a formidable track record. Our foundation and methodology developed over the course of 20 years of Digital Forensic engagements for high-profile events around the world and working with Federal Agencies such as FBI, US Secret Service, Europol, NATO, and specialized military units. This unique exposure ensures that our engineers are effectively deployed for your cyber incident and fully align with your overall mission. Our team optimizes further with unique skill-sets and the ability to conduct complex memory carving of IOC’s, noted as the most frequently attacked vector by adversaries that tend to go undetected. Our expertise includes:
- Nation States
- Cyberextortion and Ransomware
- Organized Criminals
- Insider Threat
- Hacktivists
Contact LIFARS Immediately For
Mitigating Cyber Risks in Your Organization
Credits:
https://www.sentinelone.com/blog/bluetooth-attacks-dont-let-your-endpoints-down/