4 ms·

What isn't clear is if you have a device like a laptop, phone, or tablet, and it _is_ updated post-late-2018... will that protect you from the vulnerability eve

What isn't clear is if you have a device like a laptop, phone, or tablet, and it _is_ updated post-late-2018... will that protect you from the vulnerability even if you're using an older Bluetooth device (e.g. keyboard, headset, etc.) that isn't going to ever get an update? [Edit] Found some relevant information from the Bluetooth.com security notice[1] > For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were establishing a BR/EDR connection. If one of the devices did not have the vulnerability, then the attack would not be successful. [1] https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/ https://www.bluetooth.com/security/statement-key-negotiation...

sp332 7y ago
According to https://www.kb.cert.org/vuls/id/918987/ https://www.kb.cert.org/vuls/id/918987/ either side can propose a new amount of entropy and the other side can accept or reject it. An updated controller firmware on either side could reject the connection. Another option mentioned in the paper is for the OS to check the entropy level and close the connection after each renegotiation. I'm not sure if OSes have actually been updated to do that, but it would work for all kinds of devices even without hardware vendor support.
- grenoire 7y ago
  A rejected connection means a bricked device, on the other hand. Sure, newer drivers could protect me against attacks, but simultaneously prevent me from using my BT headphones.
  - sp332 7y ago
    Hopefully this would only be an issue during an attack. Not sure why your headphones would be legitimately negotiating encryption but then only supporting <7 bytes of entropy.
    - shawnz 7y ago
      Perhaps there are devices which don't really know how to "negotiate" so much as just announce what they support using the negotiation protocol
      - roblabla 7y ago
        It still shouldn't matter unless they only support horribly insecure entropy (< 7).
        deleted 7y ago
        [deleted]
jkhfg98pghbjkl 7y ago
That's not difficult then, order one of these https://www.raspberrypi.org/products/raspberry-pi-zero-w/ https://www.raspberrypi.org/products/raspberry-pi-zero-w/ , get a battery pack and fix to some unsuspecting CEO or other juicy corporate targets vehicle. Saves trailing the vehicles and thus raising suspicion. How many car manufacturers do you think update their vehicles Bluetooth stack? Mr Robot.
ggg3 7y ago
> phone > updated phones only get a couple updates so you keep buying them new.

sp332 7y ago

According to https://www.kb.cert.org/vuls/id/918987/ https://www.kb.cert.org/vuls/id/918987/ either side can propose a new amount of entropy and the other side can accept or reject it. An updated controller firmware on either side could reject the connection. Another option mentioned in the paper is for the OS to check the entropy level and close the connection after each renegotiation. I'm not sure if OSes have actually been updated to do that, but it would work for all kinds of devices even without hardware vendor support.

grenoire 7y ago
A rejected connection means a bricked device, on the other hand. Sure, newer drivers could protect me against attacks, but simultaneously prevent me from using my BT headphones.
- sp332 7y ago
  Hopefully this would only be an issue during an attack. Not sure why your headphones would be legitimately negotiating encryption but then only supporting <7 bytes of entropy.
  - shawnz 7y ago
    Perhaps there are devices which don't really know how to "negotiate" so much as just announce what they support using the negotiation protocol
    - roblabla 7y ago
      It still shouldn't matter unless they only support horribly insecure entropy (< 7).
      - deleted 7y ago
        [deleted]

jkhfg98pghbjkl 7y ago

That's not difficult then, order one of these https://www.raspberrypi.org/products/raspberry-pi-zero-w/ https://www.raspberrypi.org/products/raspberry-pi-zero-w/ , get a battery pack and fix to some unsuspecting CEO or other juicy corporate targets vehicle. Saves trailing the vehicles and thus raising suspicion. How many car manufacturers do you think update their vehicles Bluetooth stack? Mr Robot.

ggg3 7y ago

> phone > updated phones only get a couple updates so you keep buying them new.