Bluetooth Security

[jadenerd]

I've been reading a lot in the last few days about bluetooth security vulnerabilities. Are there any settings in our Note 10's that would decrease the BT security risks when BT is turned on, which mine is all the time.

 

[jlangner]

I've been reading a lot in the last few days about bluetooth security vulnerabilities. Are there any settings in our Note 10's that would decrease the BT security risks when BT is turned on, which mine is all the time.

Make sure phone visibility is turned off I think

 

[joeldf]

If you are worried about the recent revelation of the KNOB attack on Bluetooth devices, then unless you get the August 1 security update, there's not much you can do.

The attack happens between two already connected devices. It intercepts the existing connections and injects its own encryption key bit level requirement and brute-forces it's way in with a lower bit count.

That's the vulnerability - the ability to alter the encryption entropy down to 1 bit (the range goes up to 16 bit, which is much harder to break). It's part of the original BT standard from 20 years ago that's still there. Then brute-force guessing becomes much easier, and quicker.

Of course, these kinds of attacks still takes time, requires proximity of at least Bluetooth range, and both devices with the vulnerability. If at least one is updated, I don't think the attack will work. While basic IOT devices, or car infotainment system don't usually get quick updates for such things, at least your phone will - if it's new enough to still get regular updates.

 

[jadenerd]

If you are worried about the recent revelation of the KNOB attack on Bluetooth devices, then unless you get the August 1 security update, there's not much you can do.

The attack happens between two already connected devices. It intercepts the existing connections and injects its own encryption key bit level requirement and brute-forces it's way in with a lower bit count.

That's the vulnerability - the ability to alter the encryption entropy down to 1 bit (the range goes up to 16 bit, which is much harder to break). It's part of the original BT standard from 20 years ago that's still there. Then brute-force guessing becomes much easier, and quicker.

Of course, these kinds of attacks still takes time, requires proximity of at least Bluetooth range, and both devices with the vulnerability. If at least one is updated, I don't think the attack will work. While basic IOT devices, or car infotainment system don't usually get quick updates for such things, at least your phone will - if it's new enough to still get regular updates.

Thank you so much for the thorough explanation. I did the software update right out of the box, if that is the one to which you are referring. I use BT constantly - wireless earbuds, neckphones, over the earphones, car infotainment. New phone and new tablet so, hopefully, I can leave BT running.

 

[illpoetic]

If you are worried about the recent revelation of the KNOB attack on Bluetooth devices, then unless you get the August 1 security update, there's not much you can do.

The attack happens between two already connected devices. It intercepts the existing connections and injects its own encryption key bit level requirement and brute-forces it's way in with a lower bit count.

That's the vulnerability - the ability to alter the encryption entropy down to 1 bit (the range goes up to 16 bit, which is much harder to break). It's part of the original BT standard from 20 years ago that's still there. Then brute-force guessing becomes much easier, and quicker.

Of course, these kinds of attacks still takes time, requires proximity of at least Bluetooth range, and both devices with the vulnerability. If at least one is updated, I don't think the attack will work. While basic IOT devices, or car infotainment system don't usually get quick updates for such things, at least your phone will - if it's new enough to still get regular updates.

Sounds like you're in Infosec.

 

[joeldf]

Sounds like you're in Infosec.

. Just remember reading about it from several places. Androidpolice, toms hardware, digital trends.

It was all over the place just a few weeks ago.