Bluetooth Vulnerability Affects Billions of Devices

21-Sep-2017
 

Newly disclosed vulnerability affects billions of devices that have Bluetooth connectivity installed including iPhones, Android phones, tablets, laptops, fitness trackers, in-car entertainment systems, and many others. Unfortunately, Android devices are among the least secure.

First of all, what exactly is Bluetooth?

Bluetooth is a very short range low-power wireless protocol that lets nearby devices connect to each other, generally within 30 feet or so.

Common ways we use Bluetooth (but there are dozens):

  • Cell phone earpieces -- those things you sometimes see on people's ears

  • Wireless music speakers

  • In-car hands-free systems

  • Wireless keyboards and mice

  • Smart watches and fitness trackers

Bluetooth is everywhere: All smart phones and tablets have Bluetooth. Most laptops have it. Virtually all new cars that aren't cheap, entry-level compacts have it. And even if you aren't using it, it's already turn-on by default in many devices.

But there's a critical vulnerability in the Bluetooth programming, called "BlueBorne", so-named by Armis, the security firm that discovered it. BlueBorne allows an attacker that's within range (usually 30 feet or so) to infect your phone wirelessly without you having to do anything to initiate it. No "pairing" is required for this attack to work! Simply being in range of an infected phone, like in a restaurant, bar or office, is enough to become infected! Such malware can easily hop from phone to phone like digital Tuberculosis or Measles.

To date, security analysts aren't aware of Malware in the wild exploiting this vulnerability but that's no guarantee it won't happen.

Virtually all implementations of Bluetooth are affected: Android, iOS (iPhone, iPad), Windows, Linux, and even the embedded Bluetooth entertainment systems in automobiles! This is easily the most critical smart phone / computer / device exploit discovered to date.

Apple devices are pretty much all protected at this point. Apple patched the vulnerability with the release of iOS 10 last year. And over 90% of iPhones and iPad are on iOS 10 at this time.

But Android-based phones are a different matter altogether. Android devices (except for the Pixel and Nexus models) are not updated nearly as often or thoroughly as Apple devices. I wrote articles HERE and HERE explaining why the state of Android security is so dismal.

If you have an Android-based smart phone (pretty much any phone that's not an iPhone) then you'll want to test the phone to see if it's affected by this vulnerability.

Here's how:

  • Go to the Google Play store

  • Search for "BlueBorne" (without the quotes) and you should see "BlueBorne Vulnerability Scanner by Armis" appear

  • Download and run it

  • It'll ask for several permissions -- touch "allow" for all of them


What can you do if your device is indicated as vulnerable?

  • If you don't use Bluetooth then you should turn it off, now

  • If you use Bluetooth sparingly, such as with a music speaker, turn it off and only enable when playing music at home, where you're likely safe anyway

  • If you use Bluetooth frequently, such as taking phone calls through an earpiece, then you run the risk of becoming infected if an infected phone comes within range


Calling your phone manufacturer or wireless carrier is useless. You can't really force security updates on your device. If/when a patch becomes available for your device then you'll be notified by the device. But be aware: As laid out in the linked articles above, Android updates are far from certain.

Since BlueBorne is transmitted phone-to-phone and only within close range, then using Bluetooth at home should be pretty safe. But I would advise against using Bluetooth in any public place. Again, no known exploitive Malware exists. But since some manufactures have patched the vulnerability, then reverse engineering that patch is simple for any determined hacker. That means an increased likelihood that Malware containing the BlueBorne exploit will be released.

This is why I urge people, once again, to use an iPhone. As my articles above point out, iPhones are far more secure than Android.

Why is it called "Bluetooth" anyway? Bluetooth gets it's name from the Danish viking king Harald Blåtand Gormsen, who was noted for his uncanny way of bringing people together in non-violent negotiations. Much as today's Bluetooth protocol brings disparate devices close together and into cooperative communications. "Blåtand", translated to English, is "Bluetooth". Sounds cool, too.