{"id":111833,"date":"2023-11-29T15:10:14","date_gmt":"2023-11-29T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku"},"modified":"2023-11-29T15:10:14","modified_gmt":"2023-11-29T13:10:15","slug":"bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","title":{"rendered":"BLUFFS \u2014 vulnerabilities in Bluetooth that allow for MITM attacks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Daniele Antonioli, a Bluetooth security researcher who previously developed attack techniques such as BIAS, BLUR, and KNOB, has identified two new vulnerabilities (CVE-2023-24023) in the Bluetooth session establishment mechanism. These affect all Bluetooth implementations that support the «Secure Connections» and «Secure Simple Pairing» modes, corresponding to Bluetooth Core specifications 4.2-5.4. As a demonstration of the practical application of the identified vulnerabilities, six attack variants have been developed, allowing an attacker to infiltrate the connection between previously paired Bluetooth devices. The code implementing the attack methods and tools for checking vulnerability are published on GitHub. <\/p>\n
The vulnerabilities were discovered during an analysis of the mechanisms outlined in the standard for achieving forward and future secrecy, which counteract the compromise of session keys if a persistent key is compromised (the compromise of one of the persistent keys should not lead to the decryption of previously intercepted or future sessions) and the reuse of session keys (the key from one session should not be applicable to another session). The identified vulnerabilities allow bypassing the stated protections and reusing an insecure session key across different sessions. These vulnerabilities are due to shortcomings in the base standard, are not specific to individual Bluetooth stacks, and manifest in chips from various manufacturers.
<\/center> <\/p>\n
The proposed attack methods implement different variants for spoofing classical (LSC, Legacy Secure Connections based on outdated cryptographic primitives) and secure (SC, Secure Connections based on ECDH and AES-CCM) Bluetooth connections between the system and peripheral devices, as well as organizing MITM attacks for connections in LSC and SC modes. It is assumed that all Bluetooth implementations compliant with the standard are susceptible to various forms of the BLUFFS attack. The effectiveness of the method has been demonstrated on 18 devices from companies such as Intel, Broadcom, Apple, Google, Microsoft, CSR, Logitech, Infineon, Bose, Dell, and Xiaomi.
<\/center> <\/p>\n
The essence of the vulnerabilities lies in the ability to forcefully roll back the connection to use the old LSC mode and an unreliable short session key (SK) without violating the standard. This is achieved by specifying the minimum possible entropy during the connection negotiation and ignoring the content of the authentication parameters response (CR), resulting in the generation of a session key based on constant input parameters (the session key SK is computed as KDF from a permanent key (PK) and parameters agreed upon during the session). For instance, during a MITM attack, an attacker can replace the session negotiation parameters 𝐴𝐶 and 𝑆𝐷 with zero values and set the entropy 𝑆𝐸 to 1, leading to the formation of a session key 𝑆𝐾 with an actual entropy of 1 byte (the standard minimum entropy size is 7 bytes (56 bits), which is comparable in reliability to brute-forcing a DES key). <\/p>\n
If the attacker managed to achieve the use of a shorter key during the connection negotiation, they can subsequently use brute force to determine the permanent key (PK) used for encryption and decrypt the traffic between devices. Since it is possible to initiate the use of the same encryption key during a MITM attack, if this key is guessed, it can be used to decrypt all past and future sessions intercepted by the attacker.
<\/center> <\/p>\n
To block the vulnerabilities, researchers have proposed amendments to the standard that expand the LMP protocol and change the logic of using KDF (Key Derivation Function) when generating keys in LSC mode. This change does not disrupt backward compatibility, but it leads to the inclusion of an extended LMP command and the necessity to send an additional 48 bytes. The Bluetooth SIG organization, responsible for the development of Bluetooth standards, has proposed as a protective measure to reject connections over an encrypted communication channel with keys sized up to 7 bytes. Implementations that always apply Security Mode 4 Level 4 are recommended to reject connections with keys sized up to 16 bytes. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"BLUFFS](\"\/wp-content\/uploads\/2023\/11\/eb2b7d9e0a1b270ee116ffbb2ba86a5a.png\")
<\/center> <\/p>\n![\"BLUFFS](\"\/wp-content\/uploads\/2023\/11\/497b2dc1fc82f929bd57895618bb3fa9.png\")
<\/center> <\/p>\n![\"BLUFFS](\"\/wp-content\/uploads\/2023\/11\/e27d88365015f585e8d6dace90547f46.png\")
<\/center> <\/p>\n