contador Saltar al contenido

What is BlueBorne and how it endangers billions of Bluetooth devices

With the number of smart and connected devices on the rise, concerns about online privacy and security, especially with the flow of ransomware and other malware attacks, have dominated the headlines of recent years. Although the world is trying to recover from WannaCry ransomware, the Mirai botnet and other severe malware attacks, Armis Labs security researchers have released a detailed technical whitepaper detailing a serious vulnerability that could potentially leave billions of Bluetooth-enabled devices susceptible. remote code execution and MiTM (Man-in-The-Middle) attacks. So, if you're already intrigued by BlueBorne, here's what you need to know about it, so that it doesn't end up becoming an unconscious victim of cybercrime:

What is BlueBorne?

Simply put, BlueBorne is an attack vector that allows cybercriminals to use Bluetooth connections for silently take control of targeted devices without any action on the part of the victim. What is truly disconcerting that for a device that compromises, it must not be associated with the attacker's device, it must not be set to "discoverable" mode. Up to eight separate zero-day vulnerabilities (including four critical ones) can be used for hack most Bluetooth devices currently in use, regardless of the operating system. This basically means that over 5 billion Bluetooth-enabled devices from around the world are potentially vulnerable to this huge security loophole that was described earlier this week by the ego-focused security research firm, Armis Labs. According to the technical whitepaper published by the company, BlueBorne is particularly dangerous not only for its massive size, but because the loopholes actually facilitate remote code execution and Man-in-The-Middle attacks.

Which devices / platforms are potentially vulnerable to BlueBorne?

As already mentioned, the BlueBorne attack vector potentially endangers billions of Bluetooth-enabled smartphones, desktops, entertainment systems and medical devices that run on one of the main computing platforms, including Android, iOS, Windows and Linux . Overall, there are around 2 billion Android devices in the world today, almost all of which are believed to have Bluetooth functionality. Add about 2 billion Windows devices, 1 billion Apple devices and 8 billion IoT devices to this and you will know why this latest security threat is a huge concern for cybersecurity researchers, device manufacturers and privacy defenders across the board. the world above. The two platforms most vulnerable to BlueBorne, however, are Android and Linux. This is because the way in which Bluetooth functionality is implemented in these operating systems makes them highly susceptible to memory corruption exploit which can be used to execute virtually any malicious code, allowing the attacker to access sensitive system resources on compromised devices that often fail to get rid of the infection even after several reboots.

Image courtesy:

How can hackers exploit the BlueBorne security vulnerability?

BlueBorne a highly contagious air attack vector which has the potential to spread from one device to another through the air, which means that a single compromised device can, in theory, infect dozens of devices around it. What makes users particularly vulnerable to threats high level of privileges with which Bluetooth runs on all operating systems, allowing attackers to have practically full control over compromised devices. Once under control, cybercriminals can use these devices to meet any of their nefarious goals, including cyber espionage and data theft. They can also remotely install ransomware or embed the device as part of a large botnet to perform DDoS attacks or commit other cybercrimes. According to Armis, "The BlueBorne attack vector exceeds the capabilities of most attack vectors penetrating secure "air-gapped" networks which are disconnected from any other network, including the Internet. "

How to know if your device affected by BlueBorne?

According to Armis, all major computing platforms are affected by the BlueBorne security threat one way or another, but some versions of these operating systems are inherently more vulnerable than others.

All desktops, laptops and tablets Windows running Windows Vista and versions pi recent operating system are affected by the so-called "Bluetooth Pineapple" vulnerability that allows an attacker to perform a Man-in-The-Middle attack (CVE-2017-8628).

Any device running on an operating system based on Linux kernel (version 3.3-rc1 and later) Vulnerable to the Remote Code Execution Vulnerability (CVE-2017-1000251). In addition, all Linux devices running BlueZ are also affected by the information leak vulnerability (CVE-2017-1000250). Hence, the impact of the BlueBorne attack vector not only the limitation of desktops in this case, but also a wide range of smartwatches, televisions and kitchen appliances running the free and open source Tizen operating system. That being the case, devices like the Samsung Gear S3 smartwatch or the Samsung Family Hub refrigerator would be very vulnerable to BlueBorne, according to Armis.

All iPhone, iPad and iPod Touch devices with iOS 9.3.5 o versions previous operating system are affected by the remote code execution vulnerability, as well as all AppleTV devices running tvOS version 7.2.2 or earlier. All devices with iOS 10 should be safe from BlueBorne.

Due to the reach and popularity of Android, this is the only platform believed to be the hardest hit. According to Armis, all versions of Android, none excluded, they are vulnerable to BlueBorne, thanks to four different vulnerabilities in the operating system. Two of these vulnerabilities allow remote code execution (CVE-2017-0781 and CVE-2017-0782), one results in information loss (CVE-2017-0785), while another allows a hacker to perform a Man-in-The- Central Attack (CVE-2017-0783). Smartphones and tablets on Android are not only smartphones, but also smartwatches and other wearable devices on Android Wear, televisions and set-top-boxes on Android TV and in-car entertainment systems on Android Auto, making BlueBorne one of the attack vectors most complete and strict ever documented.

If you have an Android device, you can also visit the Google Play Store and download the BlueBorne Vulnerability Scanner app released by Armis to allow users to check if their device is vulnerable to the threat.

How to protect the Bluetooth enabled device from BlueBorne?

While BlueBorne is one of the most complete and threatening attack vectors in recent memory due to its scale, there are ways you can protect yourself from becoming a victim. First of all, make sure Bluetooth is turned off on your device when you're not using it. So, make sure yours device is updated with all the latest security patches and although in some cases it does not help, it is certainly a starting point. Depending on the operating system of the device you are trying to safeguard, you should take the following steps to make sure your personal data doesn't end up in the wrong hands.

Microsoft released the BlueBorne security patch for its operating systems on July 11th, so if automatic updates have been enabled or if you have manually updated your PC in the past two months and installed all the latest security patches, you should be safe from these threats.

If you're using iOS 10 on your device, you should be fine, but if you're stuck on previous versions of the operating system (version 9.3.5 or earlier), your vulnerable device until Apple releases a security patch to correct the problem.

Google released the BlueBorne fixes to its OEM partners on August 7, 2017. The patches were also made available to users around the world as part of the September Security Update Bulletin, which was officially released on the 4th of this month. Therefore, if you are using an Android device, go to Settings> Device information> System updates to check if your vendor has already implemented the September 2017 security patch for your device. If so, install it promptly to protect yourself and your Android device from BlueBorne.

If you are using a Linux distro on your PC or use a Linux kernel based platform such as Tizen on your IoT / connected devices, you may have to wait a little longer to filter the fix due to the coordination required between the Linux security team of the kernel and security teams from various independent distros. If you have the technical know-how required, however, you can patch and rebuild the BlueZ and the kernel yourself by going here for BlueZ and here for the kernel.

In the meantime, you can simply completely disable Bluetooth on your system by following these simple steps:

  • Blacklist the main Bluetooth modules
printf "install %s /bin/truen" bnep bluetooth btusb >> /etc/modprobe.d/disable-bluetooth.con 
  • Disable and stop the Bluetooth service
 systemctl disable bluetooth.service systemctl mask bluetooth.service systemctl stop bluetooth.service 
  • Remove the Bluetooth modules
 rmmod bnep rmmod bluetooth rmmod btusb 

If you receive error messages indicating that other modules are using these services, be sure to remove the active modules first before trying again.

BlueBorne: the latest security threat endangering billions of Bluetooth devices

The Bluetooth Special Interest Group (SIG) has increasingly focused on security in recent times, and easy to understand why. With the high privileges granted to Bluetooth in all modern operating systems, vulnerabilities like BlueBorne can wreak havoc on millions of innocent and unsuspecting people around the world. What really worries security experts about the fact that BlueBorne is an aerial threat, which means that standard security measures, such as endpoint protection, mobile data management, firewalls and network security solutions are practically powerless in front of it, since they are primarily designed to block attacks that occur on IP connections. While users don't have control over how and when security patches are deployed to their devices, just making sure to take the precautions mentioned in the article should keep connected devices reasonably safe for now. In any case, keep your Bluetooth connection turned off while not using only a standard security practice that most tech-savvy people follow anyway, so now is the best time for the rest of the population to follow suit. So now that you need to know about BlueBorne, what are your thoughts on the subject? Let us know in the comments section below, because we love to hear from you.