Attackers can bypass Bluetooth encryption by exploiting new BLURtooth vulnerability null
Researchers at École Polytechnique Fédérale de Lausanne (EPFL) and Purdue University have discovered a new vulnerability in certain implementations of Bluetooth 4.0 through 5.0 which could allow an attacker to gain access to authenticated services by overwriting or lowering the strength of the pairing key.
The two teams of academic researchers came to the discovery independently and decided to call the new vulnerability, which affects “dual-mode” Bluetooth devices, BLURtooth and it is tracked as CVE-2020-15802.
Blurtooth can be exploited on devices that support Bluetooth Classic and Bluetooth Low Energy and use Cross-Transport Key Derivation (CTKD) for pairing with one another. When CTKD is used for pairing dual-mode Bluetooth devices, the procedure happens only once using either of these two data transport methods.
During the pairing process, Long Term Keys / Link Keys (LTK/LK) are generated but they can be overwritten in cases where the transport enforces a higher level of security. BLUR attacks, which leverage the BLURtooth vulnerability, take advantage of this. The Carnegie Mellon CERT Coordination Center provided more details on how BLUR attacks can gain access to authenticated services in a security advisory, saying:
“Vulnerable devices must permit a pairing or bonding to proceed transparently with no authentication, or a weak key strength, on at least one of the BR/EDR or LE transports in order to be susceptible to attack. For example, it may be possible to pair with certain devices using JustWorks pairing over BR/EDR or LE and overwriting an existing LTK or LK on the other transport. When this results in the reduction of encryption key strength or the overwrite of an authenticated key with an unauthenticated key, an attacker could gain additional access to profiles or services that are not otherwise restricted.”
BLURtooth
In a separate advisory, the Bluetooth Special Interest Group (SIG), which oversees the development of Bluetooth standards, warned that BLURtooth could also be used to launch man-in-the-middle attacks, saying:
“If a device spoofing another device’s identity becomes paired or bonded on a transport and CTKD is used to derive a key which then overwrites a pre-existing key of greater strength or that was created using authentication, then access to authenticated services may occur. This may permit a Man In The Middle (MITM) attack between devices previously bonded using authenticated pairing when those peer devices are both vulnerable.”
To carry out a man-in-the-middle attack, an attacker would need to be in close proximity to a vulnerable target device, after which they could spoof the identity of a paired device to overwrite the original key and access authenticated services.
To protect their devices from potential BLUR attacks, Bluetooth SIG recommends that vendors introduce restrictions on the Cross-Transport Key Derivation which are required in Bluetooth Core Specification versions 5.1 and later. Carnegie Mellon’s advisory has a complete list of affected vendors which will be updated once the full extent of the BLURtooth vulnerability is known.
Via BleepingComputer
Researchers at École Polytechnique Fédérale de Lausanne (EPFL) and Purdue University have discovered a new vulnerability in certain implementations of Bluetooth 4.0 through 5.0 which could allow an attacker to gain access to authenticated services by overwriting or lowering the strength of the pairing key. The two teams of academic…
