New Hacking Technique Using Bluetooth Exposed
Bluetooth makes it easy to transfer files, photos, and documents to devices, such as mobile phones, PDAs, and laptops in a short distance. This wireless communication protocol was developed in 1998. Bluetooth technology has revolutionized wireless communication between devices with its simple and ubiquitous features. Unfortunately, Bluetooth technology has increased security issues in individuals. Hackers continue to use Bluetooth vulnerabilities for various known activities, such as: theft of personal data, installation of malware and others. This is a newly discovered major security breach that not only affects mobile phones, but even cars and systems.
BlueBorne
BlueBorne is a security hole in some Bluetooth implementations. It was reviewed on April 2017 by security researchers in Armis. Vulnerabilities exist on mobile, desktop, and IoT operating systems, including Android, iOS, Windows, and Linux. This can allow hackers to take control of the device and attack the center’s users to steal information.
The researchers explained the scope of the attack vectors as follows: “For the attack, the target device does not need to be coupled to a drive device or configured invisible mode.” So far, Armis Labs has identified eight days-zero vulnerabilities indicating the existence and potential of attack vectors. Armis believes that there are more vulnerabilities to be expected on various platforms using Bluetooth, and this vulnerability is fully functional and can be exploited successfully.
BlueBorne has become a dangerous threat because of the kind of complex medium. Unlike most Internet-based attacks, BlueBorne attacks spread through the air. This means that hackers can silently connect to smartphones and computers and take control of devices without user intervention.
Btlejacking
Btlejacking, this Bluetooth attack vector, was released in August 2018 at the DefCon conference in Las Vegas by Damien Cauquil, Head of Research and Development at Digital Security. With this new technology, hackers can disrupt and recover Bluetooth devices with low power consumption. This is based on an interference vulnerability identified as CVE-2018-7252, which affects versions 4.0, 4.1, 4.2, and 5 of the BLE devices. In order to exploit the weak points, the attacker must be within 5 meters of distance.
Hundreds of millions of Bluetooth devices are potentially vulnerable to attack vectors, allowing hackers to discover BLE connections, block BLE devices, and control vulnerable Bluetooth devices. Attacks on Bluetooth enabled devices can be done with a micro-integrated BIT computer that costs only $ 15 and a few lines of open source code.
Bleedingbit
Security researchers at security firm Armis have discovered two new “BleedingBit” bugs on Bluetooth chips that affect companies around the world. The first bug, followed by CVE-2018-16986, was a remote code execution bug that involved four chip models embedded in seven Cisco access points and five Meraki access points. By exploiting the vulnerabilities, remote attackers can send dangerous BLE transmission messages, called “ad packages,” stored on vulnerable memory chips. When BLE is enabled, these malicious messages may be called to trigger a critical memory overflow. It can also allow hackers to corrupt memory, access the operating system, create a backdoor, and remotely execute malicious code.
The second chip vulnerability was identified as CVE-2018-7080 and affected multiple Aruba access points, including the full 300 series, and allowed attackers to access completely new and different firmware versions and install them.
BleedingBit is cited as a wake-up call to enterprise security for two reasons.
“First, the fact that an attacker can enter the network without any indication or warning raises serious security concerns. Second, these vulnerabilities can destroy network segmentation — the primary security strategy that most enterprises use to protect themselves from unknown or dangerous unmanaged and IoT devices. And here, the access point is the unmanaged device,” said Yevgeny Dibrov, Armis CEO in a blog post.
CarsBlues
Privacy4Cars researchers have discovered a new major vulnerability, CarsBlues, in the information and entertainment systems of different types of vehicles. This attacks can be done in minutes with cheap, available hardware and software. This allows hackers to remove personal identification information (PII) from users who have synchronized their mobile phone with their car via Bluetooth. It is estimated that tens of millions of vehicles worldwide are victims of hacker attacks.
Also, Read:
0 Comments