{"id":111833,"date":"2023-11-29T15:10:14","date_gmt":"2023-11-29T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku"},"modified":"2023-11-29T15:10:14","modified_gmt":"2023-11-29T13:10:15","slug":"bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","title":{"rendered":"BLUFFS \u2014 Bluetooth sebezhet\u0151s\u00e9gek, amelyek lehet\u0151v\u00e9 teszik a MITM-t\u00e1mad\u00e1sok v\u00e9grehajt\u00e1s\u00e1t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniele Antonioli, a Bluetooth security researcher who previously developed BIAS, BLUR, and KNOB attack techniques, has identified two new vulnerabilities (CVE-2023-24023) in the Bluetooth session negotiation mechanism that affect all Bluetooth implementations supporting the Secure Connections and Secure Simple Pairing security modes, compliant with Bluetooth Core specifications 4.2-5.4. As a demonstration of the practical application of the detected vulnerabilities, 6 attack variants have been developed, allowing intrusion into connections between previously paired Bluetooth devices. The code implementing the attack methods and the utility for checking for vulnerabilities has been published on GitHub. <\/p>\n

The vulnerabilities were discovered during the analysis of the mechanisms for achieving forward and future secrecy outlined in the standard, which counteract the compromise of session keys in the event of a permanent key being compromised (the compromise of one of the permanent keys should not lead to the decryption of previously intercepted or future sessions) and the reuse of session keys (the key from one session should not be applicable to another session). The identified vulnerabilities allow bypassing the specified protections and reusing an insecure session key across different sessions. The vulnerabilities are due to shortcomings in the base standard, are not specific to individual Bluetooth stacks, and manifest in chips from various manufacturers.

\"BLUFFS<\/center> <\/p>\n

The proposed attack methods implement different types of spoofing organization for classic (LSC, Legacy Secure Connections based on outdated cryptographic primitives) and secure (SC, Secure Connections based on ECDH and AES-CCM) Bluetooth connections between the system and peripheral device, as well as MITM attack organization for connections in LSC and SC modes. It is assumed that all Bluetooth implementations compliant with the standard are susceptible to various variants of the BLUFFS attack. The effectiveness of the method was demonstrated on 18 devices from companies such as Intel, Broadcom, Apple, Google, Microsoft, CSR, Logitech, Infineon, Bose, Dell, and Xiaomi.

\"BLUFFS<\/center> <\/p>\n

The essence of the vulnerabilities lies in the ability to forcefully revert the connection to an old LSC mode and an unreliable short session key (SK) without breaching the standard by specifying in the connection negotiation process the minimal possible entropy and ignoring the response content with the authentication parameters (CR), leading to the generation of a session key based on constant input parameters (the session key SK is computed as KDF from the permanent key (PK) and parameters agreed upon during the session). For instance, during a MITM attack, an attacker can replace the parameters on the session agreement with zero values and set the entropy to 1, resulting in the formation of a session key with an actual entropy of 1 byte (the standard minimum entropy size is 7 bytes (56 bits), which is comparable in reliability to brute-forcing DES keys). <\/p>\n

Ha a t\u00e1mad\u00f3 a kapcsolat kialak\u00edt\u00e1sa sor\u00e1n sikeresen el\u00e9rte egy r\u00f6videbb kulcs haszn\u00e1lat\u00e1t, akkor a brute force m\u00f3dszer seg\u00edts\u00e9g\u00e9vel tov\u00e1bb\u00e1 meghat\u00e1rozhatja az \u00e1lland\u00f3 kulcsot (PK), amelyet az adatforgalom titkos\u00edt\u00e1s\u00e1ra haszn\u00e1lnak, \u00e9s k\u00e9pes lesz a k\u00e9t eszk\u00f6z k\u00f6z\u00f6tti forgalom visszafejt\u00e9s\u00e9re. Mivel a MITM-t\u00e1mad\u00e1s sor\u00e1n lehet\u0151s\u00e9g van ugyanazon titkos\u00edt\u00e1si kulcs haszn\u00e1lat\u00e1nak kezdem\u00e9nyez\u00e9s\u00e9re, ha ezt a kulcsot siker\u00fcl kital\u00e1lni, akkor azt fel lehet haszn\u00e1lni az \u00f6sszes kor\u00e1bbi \u00e9s j\u00f6v\u0151beli session dek\u00f3dol\u00e1s\u00e1ra, amelyet a t\u00e1mad\u00f3 elfogott.

\"BLUFFS<\/center> <\/p>\n

A sebezhet\u0151s\u00e9gek blokkol\u00e1s\u00e1ra a kutat\u00f3k javasolt\u00e1k a szabv\u00e1ny m\u00f3dos\u00edt\u00e1s\u00e1t, amely kiterjeszti az LMP protokollt \u00e9s megv\u00e1ltoztatja a KDF (Key Derivation Function) haszn\u00e1lat\u00e1nak logik\u00e1j\u00e1t az LSC \u00fczemm\u00f3dban a kulcsok kialak\u00edt\u00e1sakor. A v\u00e1ltoztat\u00e1s nem s\u00e9rti a visszafel\u00e9 kompatibilit\u00e1st, de mag\u00e1ban foglalja az LMP utas\u00edt\u00e1s kiterjeszt\u00e9s\u00e9t, \u00e9s tov\u00e1bbi 48 byte k\u00fcld\u00e9s\u00e9nek sz\u00fcks\u00e9gess\u00e9g\u00e9t. A Bluetooth SIG, amely a Bluetooth szabv\u00e1nyok fejleszt\u00e9s\u00e9\u00e9rt felel\u0151s, mint v\u00e9delmi int\u00e9zked\u00e9s azt javasolta, hogy utas\u00edts\u00e1k el a titkos\u00edtott kapcsolatokat olyan kulcsokkal, melyek m\u00e9rete legfeljebb 7 byte. Azok a megold\u00e1sok, amelyek mindig a Security Mode 4 Level 4 szintet alkalmazz\u00e1k, azt javasolj\u00e1k, hogy utas\u00edts\u00e1k el a legfeljebb 16 byte m\u00e9ret\u0171 kulcsokkal rendelkez\u0151 kapcsolatokat.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432 Bluetooth, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0432\u0441\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Bluetooth, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0440\u0435\u0436\u0438\u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f «Secure Connections» \u0438 «Secure Simple Pairing», \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\u043c Bluetooth Core 4.2-5.4. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e 6 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111834,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BLUFFS \u2014 Bluetooth vulnerabilities enabling MITM attacks | ProHoster","description":"Daniele Antonioli, a Bluetooth security researcher who previously developed attack techniques such as BIAS, BLUR, and KNOB, has discovered two new vulnerabilities (CVE-2023-24023) in the session negotiation mechanism.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47BLUFFS \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Bluetooth, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 MITM-\u0430\u0442\u0430\u043a\u0443 | ProHoster","og:description":"\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-29T13:10:15+00:00","article:modified_time":"2023-11-29T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=111833"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/111834"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=111833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=111833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=111833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}