{"id":111833,"date":"2023-11-29T15:10:14","date_gmt":"2023-11-29T13:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku"},"modified":"2023-11-29T15:10:14","modified_gmt":"2023-11-29T13:10:15","slug":"bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","title":{"rendered":"BLUFFS \u2014 vulnerabilit\u0103\u021bi Bluetooth care permit realizarea unui atac MITM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Daniele Antonioli, cercet\u0103tor \u00een securitatea Bluetooth, care a dezvoltat anterior tehnici de atac precum BIAS, BLUR \u0219i KNOB, a identificat dou\u0103 noi vulnerabilit\u0103\u021bi (CVE-2023-24023) \u00een mecanismul de stabilire a sesiunilor Bluetooth, afect\u00e2nd toate implement\u0103rile Bluetooth care suport\u0103 modurile de asociere securizat\u0103 \u201eSecure Connections\u201d \u0219i \u201eSecure Simple Pairing\u201d, conforme cu specifica\u021biile Bluetooth Core 4.2-5.4. Ca demonstratie a aplicabilit\u0103\u021bii practice a vulnerabilit\u0103\u021bilor identificate, au fost dezvoltate 6 variante de atacuri, care permit infiltrarea \u00een conexiunea dintre dispozitivele Bluetooth deja asociate. Codul cu implementarea metodelor de atac \u0219i utilitatea pentru verificarea prezen\u021bei vulnerabilit\u0103\u021bilor a fost publicat pe GitHub. <\/p>\n

Vulnerabilit\u0103\u021bile au fost descoperite \u00een urma analizei mecanismelor descrise \u00een standard ce asigur\u0103 secretul direct (Forward and Future Secrecy), care contracareaz\u0103 compromiterea cheilor de sesiune \u00een cazul \u00een care o cheie permanent\u0103 este compromis\u0103 (compromiterea uneia dintre cheile permanente nu ar trebui s\u0103 conduc\u0103 la decriptarea sesiunilor anterioare sau viitoare) \u0219i reutilizarea cheilor de sesiune (cheia unei sesiuni nu ar trebui s\u0103 fie aplicabil\u0103 unei alte sesiuni). Vulnerabilit\u0103\u021bile descoperite permit ocolirea acestei protec\u021bii \u0219i reutilizarea unei chei de sesiune nesigure \u00een sesiuni diferite. Vulnerabilit\u0103\u021bile sunt cauzate de deficien\u021be \u00een standardul de baz\u0103, nu sunt specifice pentru stivele Bluetooth particulare \u0219i se manifest\u0103 \u00een cipurile diferitelor produc\u0103tori.

\"BLUFFS<\/center> <\/p>\n

Metodele de atac propuse implementeaz\u0103 diferite variante de spionaj al conexiunilor Bluetooth clasice (LSC, Legacy Secure Connections utiliz\u00e2nd primitivii criptografici dep\u0103\u0219i\u021bi) \u0219i conexiunilor securizate (SC, Secure Connections bazate pe ECDH \u0219i AES-CCM) \u00eentre sistem \u0219i dispozitivul periferic, precum \u0219i organizarea atacurilor MITM pentru conexiunile \u00een modurile LSC \u0219i SC. Se presupune c\u0103 toate implement\u0103rile Bluetooth conforme cu standardul sunt vulnerabile la diverse variante ale atacului BLUFFS. Func\u021bionalitatea metodei a fost demonstrat\u0103 pe 18 dispozitive de la companii precum Intel, Broadcom, Apple, Google, Microsoft, CSR, Logitech, Infineon, Bose, Dell \u0219i Xiaomi.

\"BLUFFS<\/center> <\/p>\n

Esenta vulnerabilit\u0103\u021bilor const\u0103 \u00een posibilitatea, f\u0103r\u0103 a \u00eenc\u0103lca standardul, de a for\u021ba revenirea conexiunii la utilizarea modulului vechi LSC \u0219i a unei chei de sesiune scurte nesigure (SK), prin specificarea \u00een timpul procesului de stabilire a conexiunii a entropiei minime posibile \u0219i ignor\u00e2nd con\u021binutul r\u0103spunsului cu parametrii de autentificare (CR), ceea ce duce la generarea unei chei de sesiune pe baza parametrilor de intrare permanen\u021bi (cheia de sesiune SK este calculat\u0103 ca KDF din cheia permanent\u0103 (PK) \u0219i parametrilor conveni\u021bi \u00een timpul sesiunii). De exemplu, un atacator, \u00een timpul unui atac MITM, poate \u00eenlocui \u00een procesul de stabilire a sesiunii parametrii \ud835\udc431 \u0219i \ud835\udc432 cu valori nule, iar entropia \ud835\udc52 poate fi setat\u0103 la valoarea 1, ceea ce va conduce la formarea unei chei de sesiune \ud835\udc46K cu o entropie efectiv\u0103 de 1 octet (dimensiunea minim\u0103 standard a entropiei este de 7 octe\u021bi (56 bi\u021bi), ceea ce este comparabil cu ruperea cheilor DES). <\/p>\n

Dac\u0103 atacatorului i-a reu\u0219it s\u0103 ob\u021bin\u0103 \u00een timpul negocierii conexiunii utilizarea unei chei mai scurte, el poate folosi metoda de for\u021b\u0103 brut\u0103 pentru a determina cheia permanent\u0103 (PK) utilizat\u0103 pentru criptare \u0219i poate reu\u0219i s\u0103 decripteze traficul dintre dispozitive. Deoarece \u00een cadrul unui atac MITM se poate ini\u021bia utilizarea acelea\u0219i chei de criptare, dac\u0103 aceast\u0103 cheie este determinat\u0103, atunci poate fi utilizat\u0103 \u0219i pentru decriptarea tuturor sesiunilor anterioare \u0219i viitoare interceptate de atacator.

\"BLUFFS<\/center> <\/p>\n

Pentru a bloca vulnerabilit\u0103\u021bile, cercet\u0103torii au propus modificarea standardului pentru a extinde protocolul LMP \u0219i a schimba logica utiliz\u0103rii KDF (Key Derivation Function) la formarea cheilor \u00een modul LSC. Modificarea nu afecteaz\u0103 compatibilitatea invers\u0103, dar conduce la includerea comenzii LMP extinse \u0219i la necesitatea de a trimite 48 de octe\u021bi suplimentari. Organiza\u021bia Bluetooth SIG, responsabil\u0103 pentru dezvoltarea standardelor Bluetooth, ca m\u0103sur\u0103 de protec\u021bie, a propus s\u0103 resping\u0103 conexiunile prin canalul de comunicare criptat cu chei de dimensiune de p\u00e2n\u0103 la 7 octe\u021bi. Implement\u0103rile care aplic\u0103 \u00eentotdeauna nivelul Security Mode 4 Level 4 sunt recomandate s\u0103 resping\u0103 conexiunile cu chei de dimensiune de p\u00e2n\u0103 la 16 octe\u021bi.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432 Bluetooth, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0432\u0441\u0435 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 Bluetooth, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0440\u0435\u0436\u0438\u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f «Secure Connections» \u0438 «Secure Simple Pairing», \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f\u043c Bluetooth Core 4.2-5.4. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0440\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e 6 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0430\u0442\u0430\u043a, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111834,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BLUFFS \u2014 vulnerabilit\u0103\u021bi \u00een Bluetooth care permit atacuri MITM | ProHoster","description":"Daniele Antonioli, expert \u00een securitate Bluetooth, care a dezvoltat anterior tehnici de atac BIAS, BLUR \u0219i KNOB, a identificat dou\u0103 noi vulnerabilit\u0103\u021bi (CVE-2023-24023) \u00een mecanismul de negociere a sesiunilor.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47BLUFFS \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Bluetooth, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 MITM-\u0430\u0442\u0430\u043a\u0443 | ProHoster","og:description":"\u0414\u0430\u043d\u0438\u044d\u043b\u0435 \u0410\u043d\u0442\u043e\u043d\u0438\u043e\u043b\u0438 (Daniele Antonioli), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Bluetooth, \u0440\u0430\u043d\u0435\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u0432\u0448\u0438\u0439 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0430\u0442\u0430\u043a BIAS, BLUR \u0438 KNOB, \u0432\u044b\u044f\u0432\u0438\u043b \u0434\u0432\u0435 \u043d\u043e\u0432\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-24023) \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0430\u043d\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/bluffs-uyazvimosti-v-bluetooth-pozvolyayushhie-provesti-mitm-ataku","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-29T13:10:15+00:00","article:modified_time":"2023-11-29T13:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=111833"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/111834"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=111833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=111833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=111833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}