New Unpatched Bluetooth Flaw Lets Hackers Easily Target Nearby Devices

Discovered independently by two separate teams of academic
researchers, the flaw resides in the Cross-Transport Key Derivation
(CTKD) of devices supporting both — Basic Rate/Enhanced Data Rate
(BR/EDR) and Bluetooth Low Energy (BLE) standard.

Cross-Transport Key Derivation (CTKD) is a Bluetooth component
responsible for negotiating the authenticate keys when pairing two
Bluetooth devices together, also known as “dual-mode”
devices.

“Dual-mode devices using CTKD to generate a Long Term Keys
(LTK)or Link Key (LK) are able to overwrite the original LTK or LK
in cases where that transport was enforcing a higher level of
security,” the researchers explain.

“Vulnerable devices must permit a pairing or bonding to proceed
transparently with no authentication, or a weak key strength, on at
least one of the BR/EDR or LE transports in order to be susceptible
to attack.”

In other words, the flaw leverage ability under specific
implementations of the pairing process that could allow devices to
overwrite authorization keys when the transport enforces a higher
level of security.

According to an advisory published by Carnegie Mellon
CERT Coordination Center, the flaw can lead to several potential
attacks, grouped as ‘BLUR attacks,’ including man-in-the-middle
attack.
^[2]

“If a device spoofing another device’s identity becomes paired or
bonded on a transport and CTKD is used to derive a key which then
overwrites a pre-existing key of greater strength or that was
created using authentication, then access to authenticated services
may occur,” Bluetooth SIG warned of the same.

“This may permit a Man In The Middle (MITM) attack between
devices previously bonded using authenticated pairing when those
peer devices are both vulnerable.”

Besides recommending to introduce restrictions on CTKD mandated
in Bluetooth Core
Specification^[3]
versions 5.1 and later as primary mitigation, Bluetooth SIG has
also started coordinates with affected device manufacturers to help
them release necessary patches rapidly.

“The Bluetooth SIG further recommends that devices restrict when
they are pairable on either transport to times when user
interaction places the device into a pairable mode or when the
device has no bonds or existing connections to a paired device,”
the researchers said.