about the attack (Key Negotiation Of Bluetooth) enables interception and substitution of information in encrypted Bluetooth traffic. By blocking the direct transmission of packets during the negotiation of Bluetooth device connections, an attacker can cause the session to use keys that contain just 1 byte of entropy, allowing a brute-force method to determine the encryption key.
The issue is caused by shortcomings (CVE-2019-9506) in the Bluetooth BR/EDR Core 5.1 specification and earlier versions that allow the use of overly short encryption keys and do not prevent an attacker from interfering in the connection negotiation stage, resulting in a fallback to such unreliable keys (packet substitution by unauthenticated attackers is possible). The attack can be executed during the negotiation of device connections (already established sessions cannot be attacked) and is effective only for connections in BR/EDR modes (Bluetooth Basic Rate/Enhanced Data Rate) if both devices are vulnerable. If the key is successfully guessed, the attacker can decrypt the transmitted data and subtly substitute arbitrary ciphertext into the traffic without the victim's notice.
When establishing a connection between two Bluetooth controllers A and B, controller A, after authenticating with the link key, may propose to use 16 bytes of entropy for the encryption key, and controller B may either agree to this value or specify a smaller value if it cannot generate a key of the proposed size. In response, controller A might accept the counter proposal and enable the encrypted communication channel. At this stage of parameter negotiation, encryption is not applied, allowing an attacker to intercept the data exchange between the controllers and substitute the packet with the proposed entropy size. Since the allowable key size ranges from 1 to 16 bytes, the second controller will accept this value and send its confirmation indicating the same size.
To reproduce the vulnerability in laboratory conditions (the attacker's activity was emulated on one of the devices), a
has been suggested for conducting the attack.
For a real attack, the attacker must be within the reception range of the victim devices and be able to temporarily block the signal from each device, which is proposed to be implemented through signal manipulation or reactive jamming.
The Bluetooth SIG organization, responsible for developing Bluetooth standards, is adjusting Specification number 11838, which proposes measures for manufacturers to block vulnerabilities (the minimum encryption key size has been increased from 1 to 7). The problem lies in the corresponding Bluetooth stacks and firmware of Bluetooth chips, including products , Broadcom, , , , Qualcomm, Linux, , and (out of 14 tested chips, all were found to be vulnerable). The Bluetooth stack in the Linux kernel includes a fix that allows the minimum encryption key size to be changed.
Source: opennet.ru
