{"id":18044,"date":"2023-11-30T18:28:43","date_gmt":"2023-11-30T18:28:43","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=18044"},"modified":"2023-12-28T22:05:18","modified_gmt":"2023-12-28T22:05:18","slug":"bluffs-bluetooth-vulnerability","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/bluffs-bluetooth-vulnerability\/","title":{"rendered":"BLUFFS Bluetooth Vulnerability Threatens Billions of Devices"},"content":{"rendered":"

Eurecom has uncovered a series of exploits named “BLUFFS”, posing a significant threat to the security of Bluetooth sessions<\/strong>. These attacks exploit two previously unknown flaws in the Bluetooth standard, impacting versions 4.2 through 5.4 and potentially putting billions of devices, including smartphones and laptops<\/strong>, at risk.<\/p>\n

BLUFFS Exploits \u2013 How Do They Work?<\/h2>\n

BLUFFS (Bluetooth Low User eavesdropping of Frequency-hopping Sessions) is a sophisticated series of attacks<\/strong> designed to compromise the forward and future secrecy of Bluetooth sessions<\/a>, compromising the confidentiality of communications between devices. The methodology involves exploiting flaws in the session key derivation process<\/strong>, forcing the generation of a weak and predictable session key (SKC). The attacker then brute-forces the key, allowing them to decrypt past communications and manipulate future ones.<\/p>\n

To execute BLUFFS, the attacker only needs to be within Bluetooth range<\/strong> of the targeted devices. Impersonating one device, the attacker negotiates a weak session key. Then, the other by proposing the lowest possible key entropy value<\/strong> and using a constant session key diversifier.<\/p>\n

\"Bluetooth
Bluetooth Forward and Future Secrecy Attacks and Defenses<\/figcaption><\/figure>\n

Impact on Bluetooth Devices<\/h2>\n

Given the architectural nature of the flaws, BLUFFS impacts all the devices<\/a> running a whole lineup of Bluetooth protocol versions. The vulnerabilities affect Bluetooth Core Specification 4.2 through 5.4, potentially exposing a vast number of devices to the exploits. The impact has been confirmed through tests on smartphones, earphones, and laptops<\/strong> running Bluetooth versions 4.1 through 5.2.<\/p>\n

<\/span>List of vulnerable chips\/devices<\/div>
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Chip<\/strong><\/td>\nDevice(s)<\/strong><\/td>\nBTv<\/strong><\/td>\nA1<\/strong><\/td>\nA2<\/strong><\/td>\n\nA3<\/strong><\/td>\nA4<\/strong><\/td>\nA5<\/strong><\/td>\nA6<\/strong><\/td>\n<\/tr>\n<\/thead>\n
LSC Victims<\/em><\/td>\n<\/tr>\n
Bestechnic BES2300<\/strong><\/td>\nPixel Buds A-Series<\/td>\n5.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
Apple H1<\/strong><\/td>\nAirPods Pro<\/td>\n5.0<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
Cypress CYW20721<\/strong><\/td>\nJaybird Vista<\/td>\n5.0<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
CSR\/Qualcomm BC57H687C-GITM-E4<\/strong><\/td>\nBose SoundLink<\/td>\n4.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
Intel Wireless 7265 (rev 59)<\/strong><\/td>\nThinkpad X1 3rd gen<\/td>\n4.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
CSR n\/a<\/strong><\/td>\nLogitech BOOM 3<\/td>\n4.2<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\u2713<\/td>\n<\/tr>\n
SC Vietims<\/em><\/td>\n<\/tr>\n
Infineon CYW20819<\/strong><\/td>\nCYW920819EVB-02<\/td>\n5.0<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
Cypress CYW40707<\/strong><\/td>\nLogitech MEGABLAST<\/td>\n4.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n<\/tr>\n
Qualcomm Snapdragon 865<\/strong><\/td>\nMi 10T<\/td>\n5.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Apple\/USI 339S00761<\/strong><\/td>\niPhones 12, 13<\/td>\n5.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Intel AX201<\/strong><\/td>\nPortege X30-C<\/td>\n5.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Broadcom BCM4389<\/strong><\/td>\nPixel 6<\/td>\n5.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Intel 9460\/9560<\/strong><\/td>\nLatitude 5400<\/td>\n5.0<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Qualcomm Snapdragon 835<\/strong><\/td>\nPixel 2<\/td>\n5.0<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Murata 339S00199<\/strong><\/td>\niPhone 7<\/td>\n4.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Qualcomm Snapdragon 821<\/strong><\/td>\nPixel XL<\/td>\n4.2<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n
Qualcomm Snapdragon 410<\/strong><\/td>\nGalaxy J5<\/td>\n4.1<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\u2713<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n\ud800\udd02<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
<\/div>\n<\/div><\/div>\n

Bluetooth SIG, the organization overseeing Bluetooth standard development, has received Eurecom’s report. They recommend implementations to reject connections<\/strong> with low key strengths, utilize “Security Mode 4 Level 4” for higher encryption strength<\/strong>, and operate in “Secure Connections Only” mode during pairing.<\/p>\n

Mitigation Measures<\/h2>\n

Researchers propose backward-compatible modifications to enhance session key derivation and mitigate BLUFFS and similar threats<\/strong>. Recommendations, however, offer only the protocol fixes, i.e. they are not about to be done by users. Sadly, but at the moment, there is not much you can do<\/strong> to secure the BT connection.<\/p>\n

\"BLUFFS<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Eurecom has uncovered a series of exploits named “BLUFFS”, posing a significant threat to the security of Bluetooth sessions. These attacks exploit two previously unknown flaws in the Bluetooth standard, impacting versions 4.2 through 5.4 and potentially putting billions of devices, including smartphones and laptops, at risk. BLUFFS Exploits \u2013 How Do They Work? BLUFFS […]<\/p>\n","protected":false},"author":7,"featured_media":18048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15],"tags":[211,619,315,374],"class_list":{"0":"post-18044","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"tag-bluetooth","9":"tag-cybersecurity","10":"tag-exploit","11":"tag-vulnerability"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2023\/11\/GS_Blog_banner_BLUFFS-Threatens-Billions-of-Bluetooth-Devices_1280x674-1.webp","author_info":{"display_name":"Stephanie Adlam","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/adlam\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/18044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=18044"}],"version-history":[{"count":28,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/18044\/revisions"}],"predecessor-version":[{"id":18583,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/18044\/revisions\/18583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/18048"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=18044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=18044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=18044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}