New Bluetooth bugs can be used to masquerade as a legitimate device

Vulnerability exploit can lead to MITM attacks on devices supporting the Bluetooth Core and Mesh specifications

Bluetooth vulnerabilities might cause privacy issues, monetary losses, and other perils

Researchers have released a report^[1] stating that cybercriminals could exploit vulnerabilities in any devices (smartphones, tablets, laptops, smart home appliances, etc.) that have Bluetooth wireless communication protocol^[2] on them. Since it's the most popular technology to exchange data wirelessly over a short range, you could be in danger.

The recent discovery shows that evildoers could issue Bluetooth Impersonation Attacks or BIAS for short. The attacks could happen during the establishment of a secure connection between devices. The vulnerability allows the perpetrators to bypass Bluetooth's authentication procedures.

The BIAS could only happen if the devices are discoverable (the protocol is enabled), the attacker is somewhere in the immediate vicinity, and the attackable devices were paired before, meaning a long-term key was issued. The said key is given only once, at the very first time two devices are connected.

Afterward, according to researchers:^[3]

<…> each time a secure connection is established, it uses a different session key that is extrapolated from the long-term key and other public factors.

Cybercriminals could impersonate either of the paired devices without knowing the long-term key and connect to your smartphone or another device with Bluetooth without you even realizing what's happening.

Flaws can be used to target various Bluetooth devices and lead to credential theft

Researchers have conducted BIAS attacks on 30 different popular devices, including MacBooks, iPads, iPhones, Galaxy smartphones, etc., which had 28 unique Bluetooth chips. The chips were manufactured by Qualcomm, Apple, Intel, Samsung, and other major companies. All tested devices were vulnerable to the attacks.

Cybercriminals determined to attack your device could do a lot of damage both to you and your devices. They could steal private data (files, credit card information, contacts, other sensitive details) or take over the control of the paired smartphone, tablet, etc.

The vulnerability was quickly disclosed with Bluetooth Special Interest Group (SIG), a company that oversees the development of Bluetooth standards, consequently informing all companies involved in affected device manufacturing. Most of them should have already released software and firmware updates, and others should follow shortly, so there's no need to panic.

Researchers are identifying more and more vulnerabilities

Flaws in the widely used technology are a recurring incident. While Bluetooth is used in computers, home appliances, and other equipment, the most targeted devices are smartphones. More than a year ago, a critical flaw titled CVE-2020-0022^[4] was discovered.

It enabled hackers to attack Android devices running Android Oreo (8.0 and 8.1) and Pie (9.0) versions and either steal personal data or distribute practically any kind of malware. The worst case is that no user interaction was needed during the attack; hence he/she wouldn't even know what was going on.

Other notable Bluetooth vulnerabilities include the Key Negotiation of Bluetooth (KNOB) Attack^[5] and the so-called BLURtooth vulnerability.^[6] Most of them were patched up, but more are sure to be revealed. That's why users have to stay aware that cybercriminals are always gunning for their personal details and money.

The best way to protect yourself and your device from any Bluetooth attacks is to disable the feature when you're not using it. Also, please install all updates to your software or firmware as soon as they are released.