Snippet 18: Sweytooth Example Attack Link Layer LLID Deadlock

Another SweynTooth variant: zeroing out the two Link Layer ID bits confused a particular set of BLE system-on-chips and froze them in a deadlock. A deadlock is more dangerous than a crash, because the device never reboots and watchdog processes may never notice anything is wrong.

Key Takeaways

• Filling the Link Layer ID bits with zeros deadlocked certain BLE system-on-chips
• A deadlock is more dangerous than a crash because the device stays hung instead of recovering
• Watchdog and monitoring processes often cannot detect a deadlock state
• For critical systems, a silent hang can be a serious availability and safety problem

Video Transcript

Very similar idea, but for a different set of SOCs was that there's a link layer ID, and they noted that if they filled up those two bits with zeros, it confused this particular SOCs and caused a deadlock. Now, deadlock is arguably more interesting than a crash because the device is just in a deadlock state, and it's likely that whatever watcher process you have isn't going to understand that deadlock state. So it's not like it's crashed and now it's rebooting. It may be deadlocked such that you don't even know that it's deadlocked.

So for a critical system, that could be a big problem.