New Bluetooth Bug Affects Billions of Devices

Researchers from the Singapore University of Technology and Design have published details about BrakTooth, a new family of security vulnerabilities in Bluetooth software implementations.

They assessed 13 Bluetooth devices from about a dozen vendors including Intel, Qualcomm, Texas Instruments and Cypress and found 16 vulnerabilities. On the good side, they can cause a denial of service attack (crashing the device and requiring the other to power cycle it); on the bad side it can allow remote code execution.

The researchers discovered 1,400 products affected by the vulnerabilities including phones, car radios (now called infotainment systems), computers, speakers, headphones, home entertainment systems, toys and industrial automation. Likely there are way more products vulnerable.

Estimates are that there are billions of vulnerable devices, many of which will never be fixed and remain vulnerable until they are in a landfill a decade from now.

The risk varies of course. If you home microwave fails, you may have to find a different way to heat your food. However, if factory automation software fails, it could shut down a factory or worse.

More detailed information is available at this Bleeping Computer article.

None of the vulnerabilities require the hacker to pair with the device, just be in range. The Hacker News says that proof of concept code is available online.

While the end user may think he or she is buying a device from a reputable company, that same owner has no clue where that company is buying their Bluetooth software from and whether it has been patched.

by