KNOB bluetooth vulnerabilities could expose device data to hackers
Due to a newly discovered vulnerability in the Bluetooth standard, hackers may weaken the encryption of Bluetooth devices and then snoop on the communication or take over the device. This bug does not directly crack the encryption, but rather allows the hacker to force a pair of Bluetooth devices to use weaker encryption from the beginning, which makes it easier to crack.
Each time two Bluetooth devices are connected, they create a new encryption key. If an attacker is involved in the setup process, they may spoof two devices to generate an encryption key using relatively few characters. The attacker must still perform a brute force attack on one of the devices to find the exact password, but due to this flaw, the attack is feasible and can occur in a shorter period of time.
“For example, assume that there are two controllers attempting to establish a connection: Alice and Bob. After authenticating the link key, Alice proposes that she and Bob use 16 bytes of entropy. This number, N, could be between 1 and 16 bytes. Bob can either accept this, reject this and abort the negotiation, or propose a smaller value,” explains an advisory published by the CERT Coordination Center.
“Bob may wish to propose a smaller N value because he (the controller) does not support the larger amount of bytes proposed by Alice. After proposing a smaller amount, Alice can accept it and request to activate link-layer encryption with Bob, which Bob can accept.”
However, by exploiting the reported vulnerability “an attacker, Charlie, could force Alice and Bob to use a smaller N by intercepting Alice’s proposal request to Bob and changing N.”
But it seems that most people don’t need to worry too much about this vulnerability when using Bluetooth devices. In order to perform this kind of attack, the hacker must appear during the Bluetooth device connection, block the initial transmission of each device when establishing the encryption key length, and broadcast their own messages, all of which must be completed within a short time.
At the same time, not all devices are vulnerable. This defect is only applicable to traditional Bluetooth devices, and Bluetooth low-power devices such as wearable devices are not susceptible to this. Some Bluetooth devices may be protected if they have a hard-coded minimum password strength. The Bluetooth standards organization said it could not fix the vulnerability, but it would prevent such attacks by recommending a minimum password length on vulnerable devices.
Currently, there is no evidence that the vulnerability has been maliciously used. A group of researchers published their papers at the USENIX security seminar. They named this vulnerability a KNOB attack, referred to as a “Key Negotiation of Bluetooth” attack.
