Is the Bluetooth on your device on? You better turn that off! Yes, you read that right! Everything from our smartphones to our tv and to our computers is Bluetooth-enabled and the worst part is that Bluetooth is active almost all the time in these devices because we rarely pay attention to it.
BlueBorne is an attack virus that spreads through the air and gets into a device via Bluetooth and can then take full control of the device. The targeted device does not need to be paired to the attacker’s device or even to be set on discoverable mode.
What is BlueBorne?
BlueBorne is an attack vector by which hackers can leverage Bluetooth connections to penetrate and take complete control over targeted devices. BlueBorne affects ordinary computers, mobile phones, and the expanding realm of IoT devices. The attack does not require the targeted device to be paired to the attacker’s device or even to be set on discoverable mode.
About Blueborne
The vulnerabilities found in Wi-Fi chips affect only the peripherals of the device and require another step to take control of the device. With BlueBorne, attackers can gain full control right from the start. Moreover, Bluetooth offers a wider attacker surface than WiFi, almost entirely unexplored by the research community, and hence contains far more vulnerabilities.
What is the risk?
The BlueBorne attack vector has several qualities which can have a devastating effect when combined. By spreading through the air, BlueBorne targets the weakest spot in the networks’ defense — and the only one that no security measure protects. Spreading from device to device through the air also makes BlueBorne highly infectious. Moreover, since the Bluetooth process has high privileges on all operating systems, exploiting it provides virtually full control over the device.
Unfortunately, this set of capabilities is extremely desirable to a hacker. BlueBorne can serve any malicious objective, such as cyber espionage, data theft, ransomware, and even creating large botnets out of IoT devices like the Mirai Botnet or mobile devices as with the recent WireX Botnet. The BlueBorne attack vector surpasses the capabilities of most attack vectors by penetrating secure “air-gapped” networks which are disconnected from any other network, including the internet.
How does The Attack Vector work?
First, the attacker locates active Bluetooth connections in his or her vicinity. Devices can even be identified with the “discoverable” mode set to off. Next, the attacker obtains the device’s MAC address that identifies that specific device uniquely. Then, the attacker explores the device and determines which operating system his victim is using, and adjusts his exploit accordingly. Finally, the hacker exploits a vulnerability of the Bluetooth protocol and can choose to create a Man-in-The-Middle attack and control the device’s communication or take full control over the device and use it for many cybercriminal purposes.
What Devices Are Affected?
Android
All Android phones, tablets, and wearables (except those using only Bluetooth Low Energy) of all versions are affected by four vulnerabilities found in the Android operating system, two of which allow remote code execution (CVE-2017–0781 and CVE-2017–0782), one results in information leak (CVE-2017–0785) and the last allows an attacker to perform a Man-in-The-Middle attack (CVE-2017–0783).
Windows
All Windows computers since Windows Vista are affected by the “Bluetooth Pineapple” vulnerability which allows an attacker to perform a Man-in-The-Middle attack (CVE-2017–8628).
Linux
Linux is the underlying operating system for a wide range of devices. The most commercial, and consumer-oriented platform based on Linux is the Tizen OS.
- All Linux devices running BlueZ are affected by the information leak vulnerability (CVE-2017–1000250).
- All Linux devices from version 2.6.32 (released in July 2009) until version 4.14 are affected by the remote code execution vulnerability (CVE-2017–1000251)
iOS
All iPhone, iPad, and iPod touch devices with iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower are affected by the remote code execution vulnerability (CVE-2017–14315). This vulnerability was already mitigated by Apple in iOS 10, so no new patch is needed to mitigate it. We recommend you upgrade to the latest iOS or tvOS available.
Amazon Echo and Google Home
These devices were identified as impacted by BlueBorne.
Post a Comment