New vulnerabilities allow hackers into devices via Bluetooth

MANILA, Philippines – Armis Labs, a California-based private security research company that deals with cyber threats discovered “Blueborne,” which they believe is one of the most serious Bluetooth vulnerabilities identified to date.

These types of attacks are completely airborne and even more dangerous because no pairing or authentication is required between the two devices. Without warning signals or any type of alert, users may be caught completely unaware that their device has been infiltrated and could serve as a beacon spreading malware and harmful programs to other nearby devices.  

In a press release, CEO of Armis Labs, Yevgeny Dibrov said, “These silent attacks are invisible to traditional security controls and procedures. Companies don’t monitor these types of device-to-device connections in their environment, so they can’t see these attacks or stop them.”

How it works

As seen in the video published by Armis, the hacker remotely takes control of the user’s phone, accesses the camera to snap a photo, and steals the photo taken. Armis believes that hackers can easily spread malware across millions of devices through this transmission of data. 

This is done by first forcing the device to lower its security, giving up information about itself. The hacker then uses the exploit to run his or her own code on the device which allows control over it. Through a malicious network interface, the hacker can stream data from the attacked device back to his or her own device. 

With more and more smartphones favouring  wireless connectivity and as Bluetooth enabled accessories like earbuds or speakers become more affordable, avoiding these types of attacks is not as simple as turning Bluetooth off, though it helps in certain situations. 

Is my device safe?  

Armis has already disclosed the potential threat of these exploits with device manufacturers before even letting the public know.  As a result, Windows, iOS, Android, Linux and Google devices have since rolled out patches and security updates. Older versions of other operating systems could still be vulnerable. 

According to Armis Labs, all iPhone, iPad and iPod touch devices running iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower may still be affected; updating to iOS 10 or later mitigates the threat.

They advise Android users to verify any threat by downloading their BlueBorne scanner app in the Play Store, even though a security patch was already released. Windows and Linux have also pushed out their new patches to counter these attacks. 

If there is any consolation in all of this, it is that these attacks are only possible through close proximity. Distance between the two devices involved severely limits a hacker’s chances of finding access; but, previously infected devices could still broadcast malware in public places. 

The best way to stay safe as of writing, is to keep devices updated all the time. 

Armis notes that this discovery could just be the first of many so it is best to never let devices go unchecked. – Rappler.com