A newly discovered Bluetooth vulnerability that was published this week by Intel has the potential to allow a nearby hacker to gain unauthorized access to a device, intercepting traffic and sending forged pairing messages between two vulnerable Bluetooth devices.
The vulnerability affects Bluetooth implementations and operating system drivers of Apple, Broadcom, Intel, and Qualcomm.
From Intel's explanation:
A vulnerability in Bluetooth(R) pairing potentially allows an attacker with physical proximity (within 30 meters) to gain unauthorized access via an adjacent network, intercept traffic and send forged pairing messages between two vulnerable Bluetooth(R) devices. This may result in information disclosure, elevation of privilege and/or denial of service.As BleepingComputer explains, Bluetooth-capable devices are not sufficiently validating encryption parameters in "secure" Bluetooth connections, leading to a weak pairing that can be exploited by an attacker to obtain data sent between two devices.
According to the Bluetooth Special Interest Group (SIG) it's not likely many users were impacted by the vulnerability.
For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure. The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgment to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.Both Bluetooth and Bluetooth LE are affected. Apple has already introduced a fix for the bug on its devices (in macOS High Sierra 10.13.5/10.13.6, iOS 11.4, tvOS 11.4, and watchOS 4.3.1), so iOS and Mac users do not need to worry. Intel, Broadcom, and Qualcomm have also introduced fixes, while Microsoft says its devices are not affected.
Tag: Bluetooth
28 comments
Apple supplier Foxconn today said that it remains committed to its contract to build a display plant and research facility in Wisconsin (via Reuters). The company's comment comes a few days after...
Will Smith, his wife Jada Smith, and his son Jaden Smith today visited Apple Park to discuss the environment and Jaden's Just Water company, according to a tweet Apple CEO Tim Cook shared on...
Back in March, Facebook announced that millions of Facebook passwords were stored on its servers in plain text with no encryption. At the time, Facebook also said that "tens of thousands" of...
Apple likely paid somewhere around $5 to $6 billion to settle its ongoing legal battle with Qualcomm, according to estimates shared today by UBS analyst Timothy Arcuri (via CNBC).
The...
All three 2019 iPhones will feature 12-megapixel single-lens front cameras, up from 7-megapixels on the iPhone XS, iPhone XS Max, and iPhone XR, according to the latest research note from well-known...
Apple has opened a new lab that will study how it can expand upon its current recycling processes through machine learning and robotics. The company announced the news today, along with other...
Samsung this week provided reviewers with Galaxy Fold devices for some hands-on time, and it appears the folding smartphone may be suffering from some serious flaws. Three of the reviewers who...
Apple is facing a class action lawsuit accusing the company of securities fraud for making false statements and failing to disclose adverse information regarding its business prospects. These actions...
