vulnerabilities in Bluetooth Low Energy (BLE) chips embedded in
millions of access points and networking devices used by
enterprises around the world.
Dubbed BleedingBit, the set of two vulnerabilities could
allow remote attackers to execute arbitrary code and take full
control of vulnerable devices without authentication, including
medical devices such as insulin pumps and pacemakers.
Discovered by researchers at Israeli security firm Armis, the
vulnerabilities exist in Bluetooth Low Energy (BLE) Stack
chips made by Texas Instruments (TI) that are being used by
Cisco, Meraki, and Aruba in their enterprise line of
products.
Armis is the same security firm that last year discovered
BlueBorne[1], a set of nine
zero-day Bluetooth-related flaws in Android, Windows, Linux and iOS
that affected billions of devices, including smartphones, laptops,
TVs, watches and automobile audio systems.
First BleedingBit RCE Vulnerability in BLE Chips
(CVE-2018-16986)
The first vulnerability, identified as CVE-2018-16986, exists in TI
chips CC2640 and CC2650 and affects many Cisco and Meraki’s Wi-Fi
access points. The bug takes advantage of a loophole in the way
Bluetooth chips analyze incoming data.
According to the researchers, sending more traffic to a BLE chip
than it’s supposed to handle causes memory corruption, commonly
known as a buffer overflow attack, which could allow an attacker to
run malicious code on an affected device.
“First, the attacker sends multiple benign BLE broadcast messages,
called Advertising Packets, which will be stored on the memory of
the vulnerable BLE chip in the targeted device,” researchers
explained.
“Next, the attacker sends the overflow packet, which is a
standard advertising packet with a subtle alteration – a specific
bit in its header turned ON instead of off. This bit causes the
chip to allocate the information from the packet a much larger
space than it really needs, triggering an overflow of critical
memory in the process.”
in the physical proximity of a targeted device, but once
compromised, they can take control of the access point, allowing
them to intercept network traffic, install persistent backdoor on
the chip, or launch more attacks on other connected devices over
the Internet.
Second BleedingBit OAD RCE Flaw in BLE Chips
(CVE-2018-7080)
The second vulnerability, identified as CVE-2018-7080, resides in
CC2642R2, CC2640R2, CC2640, CC2650, CC2540, and CC2541 TI chips,
and affects Aruba’s Wi-Fi access point Series 300.
This vulnerability stems from an issue with Texas Instruments’
firmware update feature in BLE chips called Over the Air Download
(OAD).
Since all Aruba access points share the same OAD password which can
be “obtained by sniffing a legitimate update or by
reverse-engineering Aruba’s BLE firmware,” an attacker can deliver
a malicious update to the targeted access point and rewrite its
operating system, gaining full control over the device.
“By default, the OAD feature is not automatically configured to
address secure firmware updates. It allows a simple update
mechanism of the firmware running on the BLE chip over a GATT
transaction,” researchers explained.
“An attacker… can connect to the BLE chip on a vulnerable access
point and upload a malicious firmware containing the attacker’s own
code, effectively allowing a completely rewrite its operating
system, thereby gaining full control over it,” the researchers
said.
Patch Related Information
Armis discovered BleedingBit vulnerabilities earlier this year and
responsibly reported all affected vendors in June 2018, and then
also contacted and worked with affected companies to help them roll
out appropriate updates to address the issues.
Texas Instruments confirmed[3]
the vulnerabilities and released security patches for affected
hardware on Thursday that will be available through respective
OEMs.
Cisco, which also owns Meraki[4], released[5] BLE-STACK version 2.2.2
for three Aironet Series wireless access points (1542 AP, 1815 AP,
4800 AP), and Meraki series access points (MR33, MR30H, MR74,
MR53E), on Thursday to address CVE-2018-16986.
Aruba has also released a security patch for its Aruba 3xx and
IAP-3xx series access points to address the CVE-2018-7080
flaw.
However, both Cisco and Aruba noted that their devices have
Bluetooth disabled by default. No vendor is aware of anyone
actively exploiting any of these zero-day vulnerabilities in the
wild.
References
Read more http://feedproxy.google.com/~r/TheHackersNews/~3/_OgmQVFokZ4/bluetooth-chip-hacking.html