Bluetooth Threats – Implementation Flaws

Unlike spec-level flaws, implementation flaws come from how vendors build Bluetooth. Examples include downgrade attacks that force plaintext through a spoofed GATT server, and an Android OS-level issue where any app can piggyback on a Bluetooth connection another app established, since the OS does not track which app owns the link.

Key Takeaways

• Implementation flaws stem from vendor code rather than the Bluetooth spec itself
• A spoofed GATT server can downgrade a connection to plaintext and inject false data, since only the client is authenticated
• On Android, any app can access a device another app connected to, because all apps share the same Bluetooth stack permissions
• Malicious apps with bad provenance make this co-located-app threat a real risk, so users must vet what they install

Video Transcript

Again, most of what we talked about previously is spec-dependent. This is all different. So one example is a downgrade attack on secure connection only. A GATT server has to authenticate a GATT client. But that's not true the opposite way, similar to what we talked about with BLESA. So a spoofed GATT server can force plaintext transmission, inject false data, et cetera. Co-located apps. This is an interesting one. With Android, it's an OS level issue.

But with Android, if an app negotiates and establishes a Bluetooth connection with some device, it has some legitimate reason to do that. Maybe it's even bonded with that device. Now, it has authenticated and encrypted connection to that device. Another app running on that OS can leverage the same stack to access that same device. And this gets scary because app stores aren't necessarily the greatest at keeping out all bad applications. So you as a user need to pay attention here as well.

You need to make sure that you're not putting an app on that has bad provenance that could be exploiting this a threat. So crazy, but it's true that they all operate at the same level of permission, and the OS doesn't actually pay attention to which app was authorized or created the connection in the first place.