Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Are ble connections neither encrypted nor authenticated? How on Earth does the connection hijacking work so simplistically?


My understanding is the initial handshake is not terribly secure, and sniffers watching that can obtain the long term key used by the pair forever.

But I gather a third party can force a handshake refresh at will, which may be what they're doing here. Code's available. : )


False, basically on every count.

This attack has zero effect on connections established using mitm-protected paring method. This attack is a non-event to any device that follows proper security design as per BT spec


There are vulnerabilities in the "standard" LE pairing, even with MITM, that make these things possible.

Fixed with the BT LE Secure Connections key exchange, but many devices don't implement that


> BLE 4.2 adds 'Secure Connections'. This is apparently also broken and what's more it was broken in 2008 when the same pairing method was used in Bluetooth 2.1!! It doesn't totally break pairing - only the passkey entry method - and you only learn the passkey, not the LTK. But it does allow an attacker to perform a MitM attack if the passkey isn't changed for every pairing attempt.

https://devzone.nordicsemi.com/f/nordic-q-a/14481/secure-ble...


Please cite


https://www.digikey.com/eewiki/display/Wireless/A+Basic+Intr...

(Heading: Pairing Methods for LE Secure Connections (4.2 devices only))


That talks about 4.2 pairing methods. I'm looking for a citation claiming that 4.1 pairing method is in any way insecure


Are you talking about the pairing protection that came in with 4.2 - released as a standard 2014-12?

I'd have to check versions of my LE BT gear, but I'd expect most of it is more than 4 years old. Earlier versions had some security on the handshake, but AFAIK just how secure that was depends on how cautious/competent the vendor was.

Happy to get more insightful information from you.


Not even looking at the code:

1. See a BLE connection in place.

2. Get address information.

3. Jam connection.

4. Watch re-authentication.

5. Use observed authentication.


Hehe.


They are both, if either side requests it. If you do not, you deserve what you get.


Ok that makes sense. I'm resisting to urge to hack my Vivosmart.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: