11 ms·
BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution
- ndrake 5y agoPoC: https://github.com/google/security-research/tree/master/pocs/linux/bleedingtooth https://github.com/google/security-research/tree/master/pocs...
- baybal2 5y agoWhat to say, very solid work
- topspin 5y agoThis first appeared six months ago.
- gerdesj 5y agohttps://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html#timeline https://google.github.io/security-research/pocs/linux/bleedi...
- fulafel 5y agoI wonder what effect self selection bias has in people who end up writing hand crafted complex parsing code in C for untrusted data in ring 0. You either have to believe that it's doable to get right or that it doesn't matter much if you don't, or "it's not my worry".
- athrowaway3z 5y ago// quick hack, fix later { .... }
- ptsneves 5y agoWhat are you trying to imply? That you have an equivalently useful and featured kernel in a safe language? Do you have a similarly featured Bluetooth stack in a "memory managed" language? Why are all OSes wrong? I apologize the readers for the rant but this whataboutism is so demeaning of the multitude of very inteligent people working in the field, and creates negative valued divides between the low level people and the userspace/web people with huge mutual distrust as shown in the parent and in mine.
- pjmlp 5y agoDo you know C.A.Hoare? I advise you to read his Turing award speech from 1981.
- snikeris 5y agohttps://www.cs.fsu.edu/~engelen/courses/COP4610/hoare.pdf https://www.cs.fsu.edu/~engelen/courses/COP4610/hoare.pdf
- IncRnd 5y agoIndeed! Hoare wrote about his self-reflection on the failures of his own software group. There was also failure in prediction, in estimation of program size and speed, of effort required, in planning the coordination and interaction of programs, in providing an early warning that things were going wrong. There were faults in our control of program changes, documentation, liaison with other departments, with our management, and with our customers. We failed in giving clear and stable definitions of the responsibilities of individual programmers and project leaders,--Oh, need I go on? What was amazing was that a large team of highly intelligent programmers could labor so hard and so long on such an unpromising project. You know, you shouldn't trust us intelligent programmers. We can think up such good arguments for convincing ourselves and each other of the utterly absurd. Especially don't believe us when we promise to repeat an earlier success, only bigger and better next time.
- rubatuga 5y agoits called a microkernel
- 0xdeaddeaf 5y agoYup. C bad, Rust good. It's not like NASA sent a rover, written almost fully in C, to Mars. It's not like billions of cars and even more billions of their ECUs are written in C. It's not like the firmware of the keyboard you're writing your comment on, or even the OS/browser you're using is written in C. C bad, Rust good.
- albntomat0 5y ago> even the OS/browser you're using is written in C Those have tons of exploitable bugs!! NASA rovers and car ECUs have minimal people looking to exploit them, so I'm not overly convinced they're exploit free either. I'm not a Rust evangelist or even a user, but the current paradigm of "THIS TIME, we'll write safe, complex, performant C/C++ code properly" isn't the solution, nor is manually squashing bugs one by one. The solution seems to be a combination of improving the tooling around existing C\C++, and starting new projects in safer languages when possible.
- fulafel 5y agoThis isn't about Rust, the same problems were well known (and long suffered & complaned about) before Rust came around and there are well known much older engineering techniques for parsing untrusted data. It's nice that the Rust phenomenon has brought with it some new spirit of vigor and momentum to break out of the apathy, though. Re Rover code and ECUs - this is the difference between safety critical code and security critical code at the attack surface. The first kind deals primarily with "don't keel over or go crazy when natural phenomena throws unexpected circumstances at you", the second deals with inputs crafted by intelligent adversaries who can see your code and test & iterate attacks to exploit any flaws they uncovered through analysis or experimentation against your implementation. (Of course if we nitpick, an intelligent attacker is a natural phenomenon.)
- aasasd 5y agoLook, it's 2020s. I'm getting put to sleep by stuff like this. You gotta amp the names up to ‘Genital Grinder’ or ‘Vomited Anal Tract’ if you want people to pay attention.
- neals 5y agoBest I can do is Poopy Dentures.
- nimbius 5y agodont forget its gotta have a vector graphic mascot and a custom TLD from a design team of MFA students. if the disclosure page doesnt take over my mouse like a new iPhone release website and include a youtube video i just cant be bothered.
- aasasd 5y agoPfah, all the graphic stuff you'd want was done ages ago: https://img.discogs.com/x-gix4VLRA0rKQTfSf4lx6HKeMw=/fit-in/600x598/filters:strip_icc():format(jpeg):mode_rgb():quality(90)/discogs-images/R-367385-1229040509.jpeg.jpg https://img.discogs.com/x-gix4VLRA0rKQTfSf4lx6HKeMw=/fit-in/...
- hyper_reality 5y agoReminds me of this from last week: https://catinthehatattack.com/ https://catinthehatattack.com/
- formerly_proven 5y ago"Blue Death spreads remote code execution like warm butter on a french toast"
- baybal2 5y agoWiFi stack, and drivers would be even more scary to look at.
- atat7024 5y agoOr kernel, where there are known unresolved issues — no looking required.
- deleted 5y ago[deleted]
- 1-6 5y agoSometimes I wonder if driver support such as Wi-Fi on FreeBSD is terrible by design. That OS has almost no attack surface.
- 1-6 5y agoFreeBSD users sit back and laugh. Bluetooth? Wifi? Hah!
- mnd999 5y agoFreeBSD has Bluetooth in netgraph last time I looked. It’s not compatible with much.
- josephg 5y agoAnd wifi. I have a little home server running FreeBSD, with an intel skylake processor from a few years ago. Wifi works out of the box. I haven’t tried Bluetooth but for my hardware, driver support has been fantastic.
- rollcat 5y agoOpenBSD 5.6 (~6 years ago) removed the Bluetooth stack altogether, due to security/maintainability concerns, so yeah, pretty much.
- rvz 5y agoWould be even more worrying if macOS or iOS also had these sort of bugs in the bluetooth stack. Plenty of iOS/Mac users using AirPods these days since Apple removed the headphone jack. Bluetooth is already turned on in the default install. Going to put this comment here as a reference to quote later when I see a zero click RCE for iOS devices using Bluetooth for drive-by exploitation.
- zibzab 5y agoOSX had I similar issue in WiFi drivers while back (also thanks to Intel), so it's not impossible.
- mjg59 5y agoWhat was notable in this case was that Google disclosed this issue to Intel, and Intel then took responsibility for public disclosure. Intel then proceeded to mail patches to public trees without flagging them as having any security relevance, posted a public disclosure despite the patches only being in pre-release kernels and claimed that affected users should upgrade to 5.9 (which had just been released) which absolutely did not have the patches fixed. Coordinating disclosure around security issues is hard, especially with a project like Linux where you have an extremely intricate mixture of long-term support kernels, vendor trees and distributions to deal with. Companies who maintain security-critical components really need to ensure that everyone knows how to approach this correctly, otherwise we end up with situations like this where the disclosure process actually increased the associated risks. (I was part of Google security during the timeline included in this post, but wasn't involved with or aware of this vulnerability)
- nimbius 5y agooof. from the guys who brought you "the spectre patch in the kernel thats disabled by default" and "ignore your doubts, hyperthreading is still safe" comes "the incredible patch built solely around shareholder confidence and breakroom communication" EDIT: spectre, not meltdown. oops. https://www.theregister.com/2018/11/20/linux_kernel_spectre_v2_patch_slowdown_intel/ https://www.theregister.com/2018/11/20/linux_kernel_spectre_...
- hansendc 5y ago> "the meltdown patch in the kernel thats disabled by default" I'm not sure to what you are referring to here. I was one of the people who worked on the Linux PTI implementation that mitigated Meltdown. My memory is not perfect, but I honestly don't know what you're referring to.
- Snild 5y agoI'm guessing they're referring to Linus' ranting on Intel here: https://lore.kernel.org/lkml/CA+55aFwOkH8RH12Dzs=hT3e7eS3Ckz9Ed6x_-9a0zs1cw9zbKA@mail.gmail.com/ https://lore.kernel.org/lkml/CA+55aFwOkH8RH12Dzs=hT3e7eS3Ckz... > The whole IBRS_ALL feature to me very clearly says "Intel is not serious about this, we'll have a ugly hack that will be so expensive that we don't want to enable it by default, because that would look bad in benchmarks".
- ipsin 5y agoThe write-up doesn't appear to have any author details, but the main page [1] credits Andy Nguyen. [1] https://google.github.io/security-research/pocs/linux/bleedingtooth/ https://google.github.io/security-research/pocs/linux/bleedi...
- Alekhine 5y agoWhat kinds of attacks could we actually see with this? Servers don't use bluetooth and desktops often don't, but Linux laptops and IOT devices often do. With Linux laptops being a rarity and IOT devices already being insecure pieces of crap whose value to a serious attacker is questionable, I fail to see how relevant this is for the average tech user.
- ptsneves 5y agoAndroid has a Linux kernel and uses it's stack. As a person in the field I can tell you that the IoT is not just smart lights. There are starting to appear smart sensors or even car infotainments which are Linux inside. Sure, car infotainments are not controlling the engine power or throttle but it is for sure requesting engine start up or displaying the glass cockpit in modern cars. Otherwise how do you think you can turn on the car with the new fancy app? From what I see we are going back from general computers running an old version of windows xp or red hat into special purpose Linux system on a module devices.
- mondoshawan 5y agoAndroid has a Linux kernel, but uses a totally different bluetooth stack called Bluedroid, and speaks raw HCI to the controller, bypassing all bluetooth drivers in the kernel.
- michaelmrose 5y agoInfotainment isn't well isolated from the more important parts of the car which use the same bus. For example I recall reading there was an example of a car which wouldn't trigger collision avoidance during a phone call because it was erroneously triggering the breaks to a very small degree and the logic was not to trigger the breaks when the user was already braking. There is every reason to believe security is as mediocre on cars as elsewhere.
- cesarb 5y agoMany desktops nowadays come with wifi, and wifi cards often also have Bluetooth. I just looked at a nearby Dell desktop (which came with wifi built-in), and it shows Bluetooth as enabled.
- BenoitEssiambre 5y agoI should be safe. After the latest ubuntu update, my bluetooth refuses to connect.
- everdrive 5y agoMy decision not to have Bluetooth pays off again!
- phendrenad2 5y agoEvery week there's a new vulnerability in the Linux kernel - is it time to admit that (A) the "many eyes" theory is disproven (B) the Linux kernel has evil malware agents "oopsing" bugs in exactly as fast as we discover them?
- Kaze404 5y agoThis comment is clearly bait, but I'm going to take it anyway and respond with a link to Microsoft's Security Response Center. This isn't exclusive to Linux at all (for better or worse) https://msrc-blog.microsoft.com/ https://msrc-blog.microsoft.com/
- phendrenad2 5y agoWould be nice if we could judge Linux on it's own merits, without comparing it to Microsoft Windows. "Your Ferrari only goes 30mph? Well it's still better than this lawnmower. Stop complaining."
- pessimizer 5y agoIf Linux is a Ferrari and the dominant commercial operating system on earth is a lawnmower, there's no metric by which Linux is failing other than grass-cutting.
- filoleg 5y ago> the "many eyes" theory is disproven The way I see it, all those vulnerabilities prove the opposite. If there were no "many eyes", I doubt most of those vulnerabilities would have been exposed to the public at all. But I bet that malicious actors would still be using those. That argument you made reads similar to "hospital theory is disproven, because whenever we get more hospitals and doctors, more people end up with a diagnosis".
- Godel_unicode 5y agoThe "many eyes" theory includes the phrase "all bugs are shallow", which to me certainly implies that they shouldn't lay there for 10+ years. The only conclusion people should be drawing from the last 20 years of security being taken seriously is that writing secure software is hard, finding bugs is hard, and business model doesn't really matter.
- dopu 5y agoThis might be a pretty naive question, but: in a hypothetical world where the vast majority of systems programming is done in "memory safe" langs, what would most vulnerabilities look like? How much safer would networked systems be, in broad strokes?
- hezag 5y agoA related post from Google Security Blog[0]: > "A recent study[1] found that "~70% of the vulnerabilities addressed through a security update each year continue to be memory safety issues.” Another analysis on security issues in the ubiquitous `curl` command line tool showed that 53 out of 95 bugs would have been completely prevented by using a memory-safe language. [...]" [0]: https://security.googleblog.com/2021/02/mitigating-memory-safety-issues-in-open.html https://security.googleblog.com/2021/02/mitigating-memory-sa... [1]: https://github.com/Microsoft/MSRC-Security-Research/blob/master/presentations/2019_02_BlueHatIL/2019_01%20-%20BlueHatIL%20-%20Trends%2C%20challenge%2C%20and%20shifts%20in%20software%20vulnerability%20mitigation.pdf https://github.com/Microsoft/MSRC-Security-Research/blob/mas...
- cyberpunk 5y agoLikely we'll have less 'os-level' pwns, but to be fair these aren't really the most exploited class of vulnerabilities today anyway. I'm just as effective doing a sql injection and stealing your client's PII if you have or don't have your bluetooth stack written in a lang that prevents some memory corruption exploits from being feasible, and that's the actual goal of most attacks. You're going to get owned in future by people obtaining creds to important stuff (say, aws creds) and by crappy userspace applications, we can hope that OS security continues to improve but even if it does get bulletproof the story is far from over while our apps are all piles of garbage. At least, that's what I recon'
- kevincox 5y agoOf course proper escaping/parameterization can be enforced in a good quality library as well. So hopefully we will see SQL injections in the future as well if these safer libraries become the default.
- r1ch 5y agoI'm curious how the "BadChoice" vulnerability did not get picked up by a static analyzer. Only initializing part of a structure should be very easy to catch.
- phab 5y agoClearly I'm missing something - in BadKarma, why does the compiler not baulk at sk_filter being passed a struct amp_mgr* instead of a struct sock* as expected? A type confusion like that ought to be prevented during typecheck, no?
- loeg 5y agoIt's indirected via `chan->data`, which is probably a `void*`. (Implicit) pointer casts between `void*` and other arbitrary types are allowed.
- phab 5y agoOf course, slow moment. Thanks. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/net/bluetooth/l2cap.h#n644 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
- orblivion 5y agoSo, tl; dr upgrade our kernels? Or is there more? (This would be useful to have on Google's site here, but I understand if it's supposed to be for academic audiences)
- young_unixer 5y agoDoes anyone pay bounties for this kind of vulnerability in the kernel or in widely used low-level libraries? I mean legally, not in darknet markets.
- cwkoss 5y agoI bet there are probably a handful of government-adjacent contractors/companies that do offensive hacking on a clandestine basis that would pay a lot for them, possibly while promising legal legitimacy. If so, they wouldn't want the public to know why they are or that they are "buying and using cyberweapons" - both to stay effective and for political/international relation reasons. So probably hard to find or contact them. I wonder how often unsolicited emails are sent to *@cia.gov with subject: "I have RCE on ___, wanna buy it?" and how they respond.
- dilippkumar 5y agoOpenBSD user: sips tea
- tediousdemise 5y agoTLDR; horrendous security exploits uncovered in code written in known unsafe language. The code is an utter shitshow, inviting disaster through seemingly normal use of the language. It contains a mess of malpractices that make any modern C++ or Rust developer cringe: goto, memcpy, naked pointers, type unsafe casts, raw loops, using malloc to allocate memory for input buffers. Why do people continue to juggle chainsaws? I think it's fear of new things, fear of change. Old habits die hard.
- 0xdeaddeaf 5y agoYou may think putting C++ and Rust in the same category against C will make your comment a bit more popular. But the reality is Rust people cringe at C++ code a lot more.
- deleted 5y ago[deleted]
- 4fips 5y agoAt least C is a complete language and a solid building block which is possible to reason about, compared to C++ which is becoming more and more bloated in a modernization attempt, so C++ projects need to be constantly updated and rewritten to catch up, which rarely happens in practise. On the other end, C++ can hardly adopt things like memory model based on Rust's borrow checker, so in this regard C++ is a dead end.
- tediousdemise 5y agoIn my mind, C++ is one of the only languages that is evolving with the times. They don’t add features that break backward compatibility, or features that sacrifice runtime performance especially if you don’t use those features. Most new features added to C++ are actually just additions to the STL, which you aren’t forced to use. It is an open standard, so there is plentiful competition in the realm of compilers. Rust only has 1 so you are SOL if you don’t like something or if the project goes bust one day.
- 5y ago
- fithisux 5y agoBT spec is huge. We need smaller and developer friendly specs.