Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
The Carnegie Mellon University (CMU) has recently shared an advisory highlighting some newly discovered Bluetooth security bugs.
The advisory states that security specialists at France’s national cybersecurity agency ANSSI have discovered multiple vulnerabilities in Bluetooth Core and Mesh specifications authorizing Man-in-the-Middle attacks.
The Bluetooth Core Specification and Mesh Profile Specification are two specifications used to define the technical and policy requirements for devices that want to operate over Bluetooth connections.
According to the Bluetooth Special Interest Group (SIG), threat actors could take advantage of these flaws in Bluetooth to conduct impersonation attacks and pretend to be an authentic device during the pairing process.
These vulnerabilities include:
CVE-2020-26558 – A flaw in the Passkey Entry protocol, employed during Secure Simple Pairing (SSP), Secure Connections (SC), and LE Secure Connections (LESC) in Bluetooth Core (v.21 – 5.2). Crafted responses could be sent throughout pairing by a threat actor to determine each bit of the randomly generated Passkey generated during pairing, resulting in impersonation.
CVE-2020-26555: Another vulnerability in Bluetooth Core (v1.0B through 5.2), the BR/EDR PIN Pairing method can also be exploited with the intention of impersonation. Cybercriminals could spoof Bluetooth device addresses of a target device, reflect encrypted nonces, and finish BR/EDR pin-code pairing without knowing the pin code. This attack requires a malicious device to be in wireless range.
CVE-2020-26560: The Mesh Provisioning procedure could allow an attacker without knowledge of the AuthValue, spoofing a device being provisioned, to use crafted responses to appear to possess the AuthValue and to be issued a valid NetKey and potentially an AppKey. For this attack to be successful, an attacking device needs to be within wireless range of a Mesh Provisioner and either spoof the identity of a device being provisioned over the air or be directly provisioned onto a subnet controlled by the provisioner.
CVE-2020-26557: Affecting Bluetooth Mesh (v.1.0, 1.0.1), the Mesh Provisioning protocol could enable hackers to carry out a brute-force attack and secure a fixed value AuthValue, or one that is “selected predictably or with low entropy,” leading to MiTM attacks on future provisioning attempts.
CVE-2020-26556: If the AuthValue can be identified during provisioning, the Bluetooth Mesh authentication protocol (v.1.0, 1.0.1) is vulnerable and may be abused to secure a Netkey. However, the researchers note that attackers must identify the AuthValue before a session timeout.
CVE-2020-26559: The Mesh Provisioning procedure could allow an attacker that was provisioned without access to the AuthValue to identify the AuthValue directly without brute-forcing its value. Even when a randomly generated AuthValue with a full 128-bits of entropy is used, an attacker acquiring the Provisioner’s public key, provisioning confirmation value, and provisioning random value, and providing its public key for use in the provisioning procedure, will be able to compute the AuthValue directly.
Even when a randomly generated AuthValue with a full 128-bits of entropy is used, an attacker acquiring the provisioner’s public key, provisioning confirmation value, and provisioning random value, and providing its public key for use in the provisioning procedure, will be able to compute the AuthValue directly.
CERT/CC identified the Android Open Source Project, Cisco, Microchip Technology, Cradlepoint, Intel, and Red Hat as being some of the companies impacted by these vulnerabilities.
The first three have issued statements confirming that they are working on releasing patches or mitigations for the security flaws, while the rest have yet to speak on the issue.
It is still unknown whether the vulnerabilities have been exploited in the wild.
Bluetooth users should make sure that they have installed the latest recommended updates from device and operating system manufacturers.
As a Senior Content Writer and Video Content Creator specializing in cybersecurity, I leverage digital media to unravel and clarify complex cybersecurity concepts and emerging trends. With my extensive knowledge in the field, I create content that engages a diverse audience, from cybersecurity novices to experienced experts. My approach is to create a nexus of understanding, taking technical security topics and transforming them into accessible, relatable knowledge for anyone interested in strengthening their security posture.
