A Vulnerability Has Been Discovered Affecting Billions of Devices

Technological devices such as billions of smartphones, tablets, laptops and ecosystem devices that we use for various purposes every day, Bluetooth technology is using. However BLESA (Bluetooth Low Energy Spoofing Attack) A new type of attack called has compromised the security of all Bluetooth devices.

The new vulnerability is a device that preserves battery power during a Bluetooth connection to establish the connection for the longest time. BLE (Bluetooth Low Energy) It affects devices executing the protocol. The vulnerability was discovered by seven researchers from Purdue University in the United States.

There were two different errors during reconnection:

Seven researchers focused on the 'reconnection' process in their studies. This process occurs during the pairing process between two BLE devices (client and server). after verifying each other it was happening. Researchers discovered the new vulnerability during this process.

Under normal circumstances, two BLE devices can interact with each other during reconnection. cryptographic key was checking. But the team of researchers found that the official BLE definition actually does not explain the reconnection process. You don't have a strong tongue saw. As a result, two systemic errors manifested themselves in the BLE software:

• Instead of requiring verification when reconnecting optional.
• Authentication is potentially compromised if the user's device cannot force the IoT device to authenticate the transmitted data. can be bypassed.

These two errors we saw opened the door for the BLESA attack. Due to bugs in BLE, hackers can bypass reconnection verifications and access the device. fake data They could send it. You can see what kind of attack the error caused in the video above, shot by the researchers.

According to the statement made by the researchers, this vulnerability in BLE has not been actually used by hackers so far. Researchers, BlueZ (Linux-based IoT devices), Fluoride (Android) and iOS BLE stacks He discovered that he was vulnerable to a BLESA attack. On the other hand, Windows devices are vulnerable to this attack. was durable.

As of June 2020, Apple has identified the vulnerability called CVE-2020-9770. closed. But researchers published last month in your articles Android BLE on devices they tested (Google Pixel XL) you're still defenseless he explained. The BlueZ developer team stated that they would take precautions to prevent the BLESA attack.