{"id":111833,"date":"2023-11-29T15:10:14","date_gmt":"2023-11-29T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku"},"modified":"2023-11-29T15:10:14","modified_gmt":"2023-11-29T13:10:15","slug":"bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","title":{"rendered":"BLUFFS — turvaaugud Bluetooth'is, mis v\u00f5imaldavad MITM-r\u00fcnnakut","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniele Antonioli, Bluetooth turvalisuse uurija, kes on varem v\u00e4lja t\u00f6\u00f6tanud BIAS, BLUR ja KNOB r\u00fcnnakute tehnikad, avastas kaks uut haavatavust (CVE-2023-24023) Bluetooth'i seansside koosk\u00f5lastamise mehhanismis, mis m\u00f5jutavad k\u00f5iki Bluetooth'i rakendusi, mis toetavad kaitstud paaritamise re\u017eiime 'Secure Connections' ja 'Secure Simple Pairing', vastavalt Bluetooth Core 4.2-5.4 spetsifikatsioonidele. N\u00e4idates tuvastatud haavatavuste praktilist rakendamist, on v\u00e4lja t\u00f6\u00f6tatud 6 r\u00fcnnaku varianti, mis v\u00f5imaldavad siseneda varem paaritatud Bluetooth-seadmete vahelisse \u00fchendusse. R\u00fcnnakute meetodite ja haavatavuste tuvastamise utiliidi kood on avaldatud GitHubis. <\/p>\n

Haavatavused tuvastati r\u00e4\u00e4kimise ajal standardis kirjeldatud mehhanismide anal\u00fc\u00fcsimisel, mis saavutavad otsese salajasuse (Forward and Future Secrecy), et kaitsta seansiv\u00f5tmete kompromiteerimise eest, kui pidev v\u00f5ti on kindlaks m\u00e4\u00e4ratud (\u00fche pideva v\u00f5tme kompromiteerimine ei tohi viia varem salvestatud v\u00f5i tulevaste seansside dekodeerimiseni) ja seansiv\u00f5tmete korduvkasutamise eest (\u00fche seansi v\u00f5ti ei tohi olla rakendatav teisele seansile). Leitud haavatavused v\u00f5imaldavad selle kaitse v\u00e4ltimist ja usaldusv\u00e4\u00e4rse seansiv\u00f5tme \u00fcmberkasutamist erinevates seanssides. Haavatavused tulenevad aluseks oleva standardi puudustest, nad ei ole spetsiifilised \u00fcksikutele Bluetoothi akudele ja ilmnevad erinevate tootjate kiipides.

\"BLUFFS<\/center> <\/p>\n

Pakutud r\u00fcnnete meetodid realiseerivad erinevaid variante klassikaliste (LSC, Legacy Secure Connections, vananenud kr\u00fcptograafiliste algprimitiventide p\u00f5hjal) ja turvaliste (SC, Secure Connections ECDH ja AES-CCM p\u00f5hjal) Bluetoothi \u00fchenduste spioneerimiseks s\u00fcsteemi ja perifeerse seadme vahel, samuti MITM-r\u00fcnnakute korraldamiseks LSC ja SC re\u017eiimide \u00fchendustes. Eeldatakse, et k\u00f5ik Bluetoothi rakendused, mis vastavad standardile, on tundlikud BLUFFS r\u00fcnnete eri variantide suhtes. Meetodi t\u00f6\u00f6 on demonstreeritud 18 seadmel, mille on valmistanud sellised ettev\u00f5tted nagu Intel, Broadcom, Apple, Google, Microsoft, CSR, Logitech, Infineon, Bose, Dell ja Xiaomi.

\"BLUFFS<\/center> <\/p>\n

Haavatavuste olemus seisneb v\u00f5imaluses, et standardit rikkumata saab sundida \u00fchenduse tagasi viima vana LSC re\u017eiimi ja usaldusv\u00e4\u00e4rset l\u00fchikest seansiv\u00f5tit (SK), m\u00e4\u00e4rates seansside koosk\u00f5lastamise protsessis minimaalset v\u00f5imalikku entropiat ja ignoreerides autentimisparameetrite (CR) vastuse sisu, mis toob kaasa seansiv\u00f5tme genereerimise, mis p\u00f5hineb konstantsetel sisendparameetritel (seansiv\u00f5ti SK arvutatakse KDF abil p\u00fcsivast v\u00f5tmest (PK) ja seansi ajal koosk\u00f5lastatud parameetritest). N\u00e4iteks saab r\u00fcndaja MITM-r\u00fcnnaku k\u00e4igus asendada seansside koosk\u00f5lastamise protsessis parameetrid 𝐴𝐶 ja 𝑆𝐷 nullv\u00e4\u00e4rtustega ning m\u00e4\u00e4rata entropia 𝑆𝐸 v\u00e4\u00e4rtuseks 1, mis toob kaasa seansiv\u00f5tme 𝑆𝐾 vormistamise, mille tegelik entropia on 1 bait (tavaline minimaalne entropia suurus on 7 baiti (56 bitti), mis usaldusv\u00e4\u00e4rsuse tasemelt on v\u00f5rreldav DES v\u00f5tmete proovimisega). <\/p>\n

Kui r\u00fcndajal \u00f5nnestub seansi l\u00e4bir\u00e4\u00e4kimiste k\u00e4igus saavutada l\u00fchema v\u00f5tme kasutamine, v\u00f5ib ta seej\u00e4rel brute force'i abil kindlaks teha konstantse v\u00f5ti (PK), mida kasutatakse kr\u00fcptimiseks, ja saada juurdep\u00e4\u00e4su seadmete vahelisele liiklusele. Kuna MITM-r\u00fcnnaku k\u00e4igus saab initsieerida sama kr\u00fcpteerimisv\u00f5tme kasutamise, siis kui see v\u00f5ti on leitud, saab seda kasutada k\u00f5igi r\u00fcndaja vahepealsete ja tulevaste seansside dekr\u00fcpteerimiseks.

\"BLUFFS<\/center> <\/p>\n

Haavatavuste blokeerimiseks on uurijad soovitanud teha standardisse muudatusi, mis laiendavad LMP protokolli ja muudavad KDF (Key Derivation Function) kasutamise loogikat LSC re\u017eiimis v\u00f5tmete genereerimisel. Muudatus ei riku tagasit\u00f5mbumist, kuid toob kaasa laiendatud LMP-k\u00e4skude lisamise ja vajaduse saata t\u00e4iendavad 48 baidi andmed. Bluetoothi standardite v\u00e4ljat\u00f6\u00f6tamise eest vastutav organisatsioon Bluetooth SIG on kaitsemeetmena soovitanud keelduda \u00fchendustest kr\u00fcpteeritud suhtluskanalites, mille v\u00f5tmed on kuni 7 baidi suurused. Implementatsioonide puhul, mis rakendavad alati Security Mode 4 Level 4 taset, soovitatakse keelduda \u00fchendustest, mille v\u00f5tmed on kuni 16 baidi suurused.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432 Bluetooth, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0432\u0441\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Bluetooth, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0440\u0435\u0436\u0438\u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f «Secure Connections» \u0438 «Secure Simple Pairing», \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\u043c Bluetooth Core 4.2-5.4. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e 6 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111834,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BLUFFS \u2014 Bluetoothi haavatavused, mis v\u00f5imaldavad MAN-IN-THE-MIDDLE r\u00fcnnakut | ProHoster","description":"Daniele Antonioli, Bluetoothi turvauurija, kes on varem v\u00e4lja arendanud BIAS, BLUR ja KNOB r\u00fcnde tehnikaid, leidis kaks uut haavatavust (CVE-2023-24023) seansside kokkuleppe mehhanismis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47BLUFFS \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Bluetooth, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 MITM-\u0430\u0442\u0430\u043a\u0443 | ProHoster","og:description":"\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-29T13:10:15+00:00","article:modified_time":"2023-11-29T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111833"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/111834"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}