A few thoughts on last month's Blueborne exploit, which should raise eyebrows for anyone deploying Bluetooth in the IoT.
Blueborne looks like a nightmare for anyone deploying Bluetooth in the IoT. Here’s the description from the firm that uncovered the exploit:
BlueBorne is an attack vector by which hackers can leverage Bluetooth connections to penetrate and take complete control over targeted devices. BlueBorne affects ordinary computers, mobile phones, and the expanding realm of IoT devices. The attack does not require the targeted device to be paired to the attacker’s device, or even to be set on discoverable mode. Armis Labs has identified eight zero-day vulnerabilities so far, which indicate the existence and potential of the attack vector.
But then there’s this:
Armis believes many more vulnerabilities await discovery in the various platforms using Bluetooth. These vulnerabilities are fully operational, and can be successfully exploited, as demonstrated in our research. The BlueBorne attack vector can be used to conduct a large range of offenses, including remote code execution as well as Man-in-The-Middle attacks.”
For the full shock value of this exploit, here’s a short video by the firm that made the discovery that explains the risk:
The BlueBorne attack vector has several stages. First, the attacker locates active Bluetooth connections around him or her. Devices can be identified even if they are not set to “discoverable” mode. Next, the attacker obtains the device’s MAC address, which is a unique identifier of that specific device. By probing the device, the attacker can determine which operating system his victim is using, and adjust his exploit accordingly. The attacker will then exploit a vulnerability in the implementation of the Bluetooth protocol in the relevant platform.
However, Parker said that up to 40 percent of the 5.3 billion impacted devices probably would not be patchable — mainly because they are IoT devices, like smart refrigerators, that cannot be easily updated. Right now, Armis said that users could disable Bluetooth to protect their connected devices while waiting for the patch.
The vulnerabilities disclosed by Armis affect all devices running on Android, Linux, Windows, and pre-version 10 of iOS operating systems, regardless of the Bluetooth version in use. This means almost every computer, mobile device, smart TV or other IoT device running on one of these operating systems is endangered by at least one of the eight vulnerabilities.
Bluetooth is not alone in this ease of discovery. WiFi and IEEE 802.15.4xx are just two examples of stacks (or semi-stacks) that weren’t conceived with the modern IoT in mind. Even more recent attempts like LoRaWAN were architected without thinking this through.
In the world of IoT wireless protocol development, device discovery seems to (usually) be the job given the guys who weren’t smart enough to work on documentation. But if we are just seeing the beginning of hacks like Blueborne — as the author of the vulnerabilty suggests — the solution to limiting IoT device discovery is a billion dollar opportunity.
