Bluetooth is hacked (again)

[Levisallanon]

Scientists at Armis have discovered a new leak in bluetooth:
https://www.armis.com/blueborne/

Ofcourse the major OS developers jumped on this and fixed it as you can read here:

https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/

 

But most android users will probably be left waiting for their phone provider to provide this update, if it will be provided at all.
One thing is for sure, driving in traffic can become a lot more interesting if you can screw with other people's phone while waiting for the cars to move along ;).

 

[ScratchCat]

Well great. According to the article this could affect 8.2 BILLON devices , more than there are humans alive 

As always Samsung doesn't do anything.

[Katsunaka]

Welp, you can hack my headphones, portable speaker all you want.  

 

My phones BT has to be on for you to hack it. So have fun with that. 

[ignaloidas]

My phones BT has to be on for you to hack it. So have fun with that. 

  if you're using your headphones, you use bluetooth :D

[goodtofufriday]

Does anyone even transfer sensitive data over bluetooth anymore?

[ignaloidas]

3 hours ago, goodtofufriday said:

Does anyone even transfer sensitive data over bluetooth anymore?

I think you didn't understand. Bluetooth is like air for viruses(human ones), and the stuff that's hack able is inside the phone that they can control.

[goodtofufriday]

12 minutes ago, ignaloidas said:

I think you didn't understand. Bluetooth is like air for viruses(human ones), and the stuff that's hack able is inside the phone that they can control.

Ah, next time I should read the article lol. I did not see that this hack allows them to inject code directly to the device.

[sazrocks]

Quote

Samsung – Contact on three separate occasions in April, May, and June. No response was received back from any outreach.

Good job Samsung, always out there protecting their users.

 

/s

[JoostinOnline]

4 hours ago, ScratchCat said:

Well great. According to the article this could affect 8.2 BILLON devices , more than there are humans alive 

As always Samsung doesn't do anything.

It's more than Samsung.  Patches need to be created by Google, then applied by the manufacturer to the specific device, then released by the service provider.  That's why it always takes so long for updates on Android.  Even if all three are fast about it (which they almost never are), it takes weeks.

[Levisallanon]

11 minutes ago, JoostinOnline said:

It's more than Samsung.  Patches need to be created by Google, then applied by the manufacturer to the specific device, then released by the service provider.  That's why it always takes so long for updates on Android.  Even if all three are fast about it (which they almost never are), it takes weeks.

The patches are already provided by google. They where very fast to produce them. Problem here also is that a lot of manufacturers don't send updates to all phones so if google only releases the update for the latest version of android then everyone with a lower version is screwed already.... (I'm not sure for which android version google released the patch).

[themctipers]

I still never use bluetooth on my PC or iPhone...

99.3% safe. 

[Jito463]

27 minutes ago, themctipers said:

I still never use bluetooth on my PC or iPhone...

99.3% safe. 

I rarely use it on mine, except in very specific circumstances.

^{_{*and suddenly, a new exploit is announced that turns your BT on without any user intervention*}}

[JoostinOnline]

2 hours ago, Levisallanon said:

The patches are already provided by google. They where very fast to produce them. Problem here also is that a lot of manufacturers don't send updates to all phones so if google only releases the update for the latest version of android then everyone with a lower version is screwed already.... (I'm not sure for which android version google released the patch).

Again, they can't just send the patches to phones. A custom one has to be applied for each phone, and then the service provider has to make their changes (often with some extra bloatware) and push it out.  Manufacturers are just one cog in the machine.

[vanished]

Well that sounds serious for anyone who uses it regularly, but I guess an obvious way to protect yourself in the mean time is just turn it off lol

Easier said than done if you rely on it for headphones/etc tho

Luckily I don't

[Levisallanon]

1 minute ago, Ryan_Vickers said:

Well that sounds serious for anyone who uses it regularly, but I guess an obvious way to protect yourself in the mean time is just turn it off lol

Easier said than done if you rely on it for headphones/etc tho

Luckily I don't

This is why I said I'm going to have fun in trafic with everyone relying on bluetooth to sync their phone with their handfree set ;).

[captain_to_fire]

So I guess iPhones and iPads are safe because the article only mentioned iOS devices prior to iOS 10. Phew! 

[captain_to_fire]

I wonder Bluetooth of cars are also vulnerable. I always pair my iPhone to my car to play music or podcasts when I'm driving especially long road trips. Since iOS 10 has patched the vulnerability, would it matter if my car's Bluetooth is still vulnerable if paired with an iPhone or any phone who has patched the vulnerability? 

[Levisallanon]

3 minutes ago, hey_yo_ said:

I wonder Bluetooth of cars are also vulnerable. I always pair my iPhone to my car to play music or podcasts when I'm driving especially long road trips. Since iOS 10 has patched the vulnerability, would it matter if my car's Bluetooth is still vulnerable if paired with an iPhone or any phone who has patched the vulnerability? 

The music player might be vulnerable, but this is often running something weird. Unless your car has a complete operating system where you connect with I wouldn't worry about it.

[suicidalfranco]

3 hours ago, hey_yo_ said:

So I guess iPhones and iPads are safe because the article only mentioned iOS devices prior to iOS 10. Phew! 

rest in piece jailbreak Community 

[captain_to_fire]

22 minutes ago, suicidalfranco said:

rest in piece jailbreak Community 

Even the Cydia creator said that jail breaking is dead because Apple is making it harder since iOS 10. https://www.google.com.ph/amp/s/www.cultofmac.com/490594/jailbreaking-pioneers-say-iphone-jailbreaking-dead/amp/

[ScratchCat]

8 hours ago, JoostinOnline said:

It's more than Samsung.  Patches need to be created by Google, then applied by the manufacturer to the specific device, then released by the service provider.  That's why it always takes so long for updates on Android.  Even if all three are fast about it (which they almost never are), it takes weeks.

I agree, that's most likely why they gave them since April or so. However the article states that Samsung didn't even respond to them while Google and others did.

[Hiitchy]

My hearing aids have bluetooth... What are you gonna do... Hack my thoughts?

[vanished]

19 minutes ago, Hiitchy said:

My hearing aids have bluetooth... What are you gonna do... Hack my thoughts?

no, something much worse...

[niculw]

5 hours ago, hey_yo_ said:

I wonder Bluetooth of cars are also vulnerable. I always pair my iPhone to my car to play music or podcasts when I'm driving especially long road trips. Since iOS 10 has patched the vulnerability, would it matter if my car's Bluetooth is still vulnerable if paired with an iPhone or any phone who has patched the vulnerability? 

I would guess this hack only works for masters and not for slave. Your car would be a slave in this case. If it is vulnerable to a man in the middle attack, it could be "hacked" but all the hacker could get is just your phone conversation or music you are playing. Nothing interesting, since you dont store important info on slaves. However if you want to be very malicious and it is vulnerable to code injection, you could be able to gain control of the bluetooth microcontroller and from there, if you are very unlucky that the output goes to an OS and not just the amp, and if that OS allows commands other than audio, contacts info or maybe traffic. Then you are fucked. Because then your attacker would be able to maybe shutdown the car computer, maybe even control speed and such, though the person would have to be right next to you, unless they made a specific transmitter and threw it into your car, in which case you should really think about who you piss off.

[Hiitchy]

8 hours ago, Ryan_Vickers said:

no, something much worse...

Well, I've already booked an appointment with my audiologist to disable the bluetooth module on my hearing aids. She said about 5 other people called requesting the same thing. She's in the dark about this whole thing right now.