about the attack (Key Negotiation Of Bluetooth), which allows for the interception and injection of information in encrypted Bluetooth traffic. By blocking the direct transfer of packets during the negotiation of Bluetooth device connections, an attacker can force a session to use keys containing only 1 byte of entropy, making it possible to apply a brute-force method to determine the encryption key.
The problem is caused by flaws (CVE-2019-9506) in the Bluetooth BR/EDR Core 5.1 specification and earlier versions, allowing the use of excessively short encryption keys and failing to prevent an attacker from interfering at the connection negotiation stage to revert to such unreliable keys (packet injection by unauthenticated attackers is possible). The attack can occur during the connection negotiation between devices (established sessions cannot be attacked) and is effective only for connections in BR/EDR modes (Bluetooth Basic Rate/Enhanced Data Rate), if both devices are vulnerable. In the event of a successful key cracking, an attacker can decrypt transmitted data and stealthily perform injection into the traffic of arbitrary ciphertext.
When establishing a connection between two Bluetooth controllers A and B, after authentication via a link key, controller A may propose to use 16 bytes of entropy for the encryption key, and controller B can either accept this value or specify a smaller value if it cannot generate a key of the proposed size. In response, controller A may accept the counter-proposal and activate the encrypted communication channel. At this stage of parameter negotiation, encryption is not applied, allowing the attacker to intercept the data exchange between the controllers and replace the packet with the proposed entropy size. Since the acceptable key size ranges from 1 to 16 bytes, the second controller will accept this value and send its confirmation indicating the same size.
To reproduce the vulnerability in laboratory conditions (the attacker's activity was emulated on one of the devices), a
for conducting the attack is proposed.
För en verklig attack måste angriparen befinna sig inom siktområdet av offrens enheter och ha möjlighet att kortvarigt blockera signalen från varje enhet, vilket föreslås att genomföras genom att manipulera signalen eller reaktivt störa.
Bluetooth SIG, organisationen som ansvarar för utvecklingen av Bluetooth-standarder, justerade specifikationen med nummer 11838, där åtgärder för att blockera sårbarheten föreslås för tillverkare (den minimi storlek för krypteringsnyckeln har höjts från 1 till 7). Problemet är kopplade till standard Bluetooth-stacken och Bluetooth-chipens fast firmware, inklusive produkter , Broadcom, , , , Qualcomm, Linux, , och (av 14 testade chips visade sig alla vara sårbara). I Linux-kärnans Bluetooth-stack en fix som tillåter ändring av den minimi storleken på krypteringsnyckeln.
Källa: opennet.ru
