{"id":111833,"date":"2023-11-29T15:10:14","date_gmt":"2023-11-29T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku"},"modified":"2023-11-29T15:10:14","modified_gmt":"2023-11-29T13:10:15","slug":"bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","title":{"rendered":"BLUFFS \u2014 vulnerabilidades no Bluetooth que permitem ataques MITM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniele Antonioli, pesquisador de seguran\u00e7a Bluetooth, que anteriormente desenvolveu t\u00e9cnicas de ataque BIAS, BLUR e KNOB, identificou duas novas vulnerabilidades (CVE-2023-24023) no mecanismo de negocia\u00e7\u00e3o de sess\u00f5es Bluetooth, que afetam todas as implementa\u00e7\u00f5es do Bluetooth suportando os modos de emparelhamento seguro 'Secure Connections' e 'Secure Simple Pairing', de acordo com as especifica\u00e7\u00f5es do Bluetooth Core 4.2-5.4. Como demonstra\u00e7\u00e3o da aplica\u00e7\u00e3o pr\u00e1tica das vulnerabilidades identificadas, foram desenvolvidos 6 tipos de ataques que permitem intervir na conex\u00e3o entre dispositivos Bluetooth previamente emparelhados. O c\u00f3digo com a implementa\u00e7\u00e3o dos m\u00e9todos de ataque e as utilidades para verificar a presen\u00e7a das vulnerabilidades foram publicados no GitHub. <\/p>\n

As vulnerabilidades foram descobertas durante a an\u00e1lise dos mecanismos descritos na norma para alcan\u00e7ar a segredo direto (Forward and Future Secrecy), que visam combater a comprometimento das chaves de sess\u00e3o no caso da identifica\u00e7\u00e3o de uma chave permanente (a comprometimento de uma das chaves permanentes n\u00e3o deve levar \u00e0 decripta\u00e7\u00e3o de sess\u00f5es previamente interceptadas ou futuras) e \u00e0 reutiliza\u00e7\u00e3o das chaves de sess\u00e3o (a chave de uma sess\u00e3o n\u00e3o deve ser aplicada a outra sess\u00e3o). As vulnerabilidades encontradas permitem contornar essa prote\u00e7\u00e3o e reutilizar uma chave de sess\u00e3o n\u00e3o confi\u00e1vel em diferentes sess\u00f5es. As vulnerabilidades s\u00e3o causadas por falhas na norma b\u00e1sica, n\u00e3o s\u00e3o espec\u00edficas para pilhas Bluetooth individuais e se manifestam em chips de v\u00e1rios fabricantes.

\"BLUFFS<\/center> <\/p>\n

Os m\u00e9todos de ataque propostos implementam diferentes variantes de spoofing de conex\u00f5es Bluetooth cl\u00e1ssicas (LSC, Legacy Secure Connections baseadas em primitivos criptogr\u00e1ficos obsoletos) e protegidas (SC, Secure Connections baseadas em ECDH e AES-CCM) entre o sistema e o dispositivo perif\u00e9rico, al\u00e9m de organizar ataques MITM para conex\u00f5es nos modos LSC e SC. Sup\u00f5e-se que todas as implementa\u00e7\u00f5es de Bluetooth que atendem ao padr\u00e3o estejam suscet\u00edveis a v\u00e1rias formas do ataque BLUFFS. O funcionamento do m\u00e9todo foi demonstrado em 18 dispositivos de empresas como Intel, Broadcom, Apple, Google, Microsoft, CSR, Logitech, Infineon, Bose, Dell e Xiaomi.

\"BLUFFS<\/center> <\/p>\n

A ess\u00eancia das vulnerabilidades reside na possibilidade de, sem violar o padr\u00e3o, for\u00e7ar a conex\u00e3o a reverter para o antigo modo LSC e uma chave de sess\u00e3o (SK) pouco confi\u00e1vel, atrav\u00e9s da especifica\u00e7\u00e3o durante o processo de negocia\u00e7\u00e3o da conex\u00e3o de uma entropia m\u00ednima poss\u00edvel e ignorando o conte\u00fado da resposta com os par\u00e2metros de autentica\u00e7\u00e3o (CR), o que resulta na gera\u00e7\u00e3o de uma chave de sess\u00e3o baseada em par\u00e2metros de entrada constantes (a chave de sess\u00e3o SK \u00e9 calculada como KDF de uma chave constante (PK) e dos par\u00e2metros acordados durante a sess\u00e3o). Por exemplo, um atacante durante um ataque MITM pode substituir durante a negocia\u00e7\u00e3o de sess\u00e3o os par\u00e2metros \ud835\udc59\ud835\udc4f e \ud835\udc59\ud835\udc54 por valores zero, e definir a entropia \ud835\udc59\ud835\udc53 para um valor de 1, resultando na forma\u00e7\u00e3o de uma chave de sess\u00e3o \ud835\udc59\ud835\udc5f com uma entropia efetiva de 1 byte (tamanho m\u00ednimo de entropia padr\u00e3o \u00e9 de 7 bytes (56 bits), o que equivale ao n\u00edvel de seguran\u00e7a de um ataque de for\u00e7a bruta a chaves DES). <\/p>\n

Se, durante o processo de negocia\u00e7\u00e3o da conex\u00e3o, o atacante conseguir fazer com que uma chave mais curta seja utilizada, ele pode ent\u00e3o, por meio de ataque de for\u00e7a bruta, determinar a chave constante (PK) usada para criptografia e conseguir decifrar o tr\u00e1fego entre os dispositivos. Como em um ataque MITM \u00e9 poss\u00edvel iniciar o uso da mesma chave de criptografia, se essa chave for decifrada, ela pode ser empregada para decifrar todas as sess\u00f5es passadas e futuras interceptadas pelo atacante.

\"BLUFFS<\/center> <\/p>\n

Para bloquear as vulnerabilidades, foi proposto pelo pesquisador fazer altera\u00e7\u00f5es no padr\u00e3o que expandem o protocolo LMP e modificam a l\u00f3gica de uso do KDF (Key Derivation Function) na forma\u00e7\u00e3o de chaves no modo LSC. A altera\u00e7\u00e3o n\u00e3o compromete a compatibilidade reversa, mas resulta na inclus\u00e3o de um comando LMP estendido e na necessidade de envio de 48 bytes adicionais. A organiza\u00e7\u00e3o Bluetooth SIG, respons\u00e1vel pelo desenvolvimento dos padr\u00f5es Bluetooth, como medida de prote\u00e7\u00e3o, sugeriu rejeitar conex\u00f5es em canais de comunica\u00e7\u00e3o criptografados com chaves de at\u00e9 7 bytes. Implementa\u00e7\u00f5es que sempre aplicam o n\u00edvel Security Mode 4 Level 4 s\u00e3o recomendadas a rejeitar conex\u00f5es com chaves de at\u00e9 16 bytes.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432 Bluetooth, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0432\u0441\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Bluetooth, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0440\u0435\u0436\u0438\u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f «Secure Connections» \u0438 «Secure Simple Pairing», \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\u043c Bluetooth Core 4.2-5.4. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e 6 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111834,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BLUFFS \u2014 vulnerabilidades no Bluetooth que permitem realizar um ataque MITM | ProHoster","description":"Daniele Antonioli, pesquisador de seguran\u00e7a Bluetooth, que anteriormente desenvolveu t\u00e9cnicas de ataque como BIAS, BLUR e KNOB, descobriu duas novas vulnerabilidades (CVE-2023-24023) no mecanismo de negocia\u00e7\u00e3o de sess\u00f5es.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47BLUFFS \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Bluetooth, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 MITM-\u0430\u0442\u0430\u043a\u0443 | ProHoster","og:description":"\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-29T13:10:15+00:00","article:modified_time":"2023-11-29T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/111833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=111833"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/111833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/111834"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=111833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=111833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=111833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}