Cloud Security Tip: KNOB Attack

Bluetooth is a convenient and easy method of sharing data between devices, which, of course, qualifies it as a prime target for exploitation. A trio of researchers has discovered a vulnerability that has the potential of attacking billions of Bluetooth-enabled devices, including phones, laptops, IoT and IIoT technologies.

In short, this Key Negotiation of Bluetooth vulnerability, which has been given the acronym KNOB, exploits the pairing encryption protocol within the Bluetooth Classic wireless technology standard, which supports encryption keys with entropy between 1 and 16 bytes/octets. It inserts between the pairing devices forcing both to agree to encryption with 1 byte or 8 bits of entropy, after which it simply brute-forces the encryption keys.

This is not an easy hack, and relies a lot on time and place, and it does not affect all Bluetooth devices. However, when successful, it can steal data and inject ciphertext. More information is available at knobattack.com.

This tip originally appeared on David Spark's CISO/Security Vendor Relationship Podcast: https://cisoseries.com/rest-assured-were-confident-our-security-sucks/

Видео Cloud Security Tip: KNOB Attack канала OpenVPN