{"id":2363,"date":"2018-11-02T14:46:49","date_gmt":"2018-11-02T03:46:49","guid":{"rendered":"https:\/\/techsuccess.com.au\/?p=2363"},"modified":"2018-11-02T14:48:31","modified_gmt":"2018-11-02T03:48:31","slug":"critical-bluetooth-vulnerability-exposes-millions-of-devices","status":"publish","type":"post","link":"https:\/\/techsuccess.com.au\/critical-bluetooth-vulnerability-exposes-millions-of-devices\/","title":{"rendered":"Critical Bluetooth Vulnerability Exposes Millions Of Devices"},"content":{"rendered":"

Security researchers from Israeli security firm Armis, have unveiled details of two critical vulnerabilities in Bluetooth’s Low Energy Chips (BLE) that are embedded in millions of access points and networking devices used by enterprises around the world. Throughout this article, we will look to bring light into the situation to make sure that you’re better equipped in understanding how critical this can be if you’re breached.\u00a0<\/strong><\/p>\n

Titled BleedingBit<\/em>, the set of two vulnerabilities are one of the worst found within Bluetooth in recent years. This vulnerability allowed\u00a0attackers to execute arbitrary code which will allow full control of vulnerable devices without the authentication process, not only that, the vulnerabilities can also access point-of-sales\/IoT devices, and worst of all attackers are also given access medical devices such as insulin pumps and pacemakers through these two flaws.<\/p>\n

The vulnerability exists in\u00a0Bluetooth Low Energy (BLC) Stak Chip<\/strong> made by Texas\u00a0Instruments (TI) that are being used by Cisco, Meraki, and Aruba in their enter enterprise line of products.<\/p>\n

Who is Armis?<\/h3>\n

Armis<\/a> <\/span>is the same security firm that last year discovered BlueBorne<\/a><\/span>, a set of nine Zero-Day Bluetooth-related flaws in Android, Windows, Linux and IOS that affected billions of devices, including smartphones, laptops, TVs, watches and automobile audio systems.<\/p>\n

BleedingBit RCE Vulnerability #1 BLE Chips (CVE-2018-16986)<\/h3>\n

The first Bluetooth vulnerability exists in TI chips CC2640 and CC2650 and affects many Cisco and Meraki’s\u00a0Wi-Fi access points. Labels as CVE-2018-16986, the bug takes advantage of a loophole in the way Bluetooth chips analyze incoming data.<\/p>\n

The vulnerability works by driving more traffic to a BLE chip that it’s supposed to handle which then causes a memory corruption, commonly known as a buffer overflow attack, which could allow an attacker to run malicious code on an affected device.<\/p>\n

“First, the attacker sends multiple benign BLE broadcast messages, called Advertising Packets, which will be stored on the memory of the vulnerable BLE chip in the targeted device,” researchers explained.<\/p>\n

“Next, the attacker sends the overflow packet, which is a standard advertising packet with a subtle alteration \u2013 a specific bit in its header turned ON instead of off. This bit causes the chip to allocate the information from the packet a much larger space than it really needs, triggering an overflow of critical memory in the process.” teh researchers continued<\/span><\/a>.<\/p><\/blockquote>\n

 <\/p>\n

\n