Researcher’s discovered 2 critical Bluetooth vulnerabilities in BLE (Bluetooth Low Energy) is named as ” BLEEDINGBIT ” affected millions of BLE embedded devices that allows an attacker to access enterprise network without authentication.
These serious vulnerabilities existing in the BLE which is made by Texas Instruments (TI) that embedded in access points to provide Wi-Fi to enterprise networks.
It was discovered in network devices that manufactured by Cisco, Meraki, and Aruba which is used in almost 70% of worldwide computer networks.
The Critical flaw gives very sensitive access to attackers who can able to breaking network segmentation once they take over the Wi-Fi access point.
Apart from the network devices that using BLE chips, it also affected IoT devices, medical centers use BLE to track the location of beacons on valuable assets like resuscitation carts, the point of sales devices, smart locks, hotel chain, cars where BLE Chip establish established Bluetooth protocol.
First BleedingBit RCE Vulnerability in BLE Chips (CVE-2018-16986)
The first vulnerability, identified as CVE-2018-16986, exists in TI chips CC2640 and CC2650 and affects many Cisco and Meraki’s Wi-Fi access points. The bug takes advantage of a loophole in the way Bluetooth chips analyze incoming data.
According to the researchers, sending more traffic to a BLE chip than it’s supposed to handle causes memory corruption, commonly known as a buffer overflow attack, which could allow an attacker to run malicious code on an affected device.
“First, the attacker sends multiple benign BLE broadcast messages, called Advertising Packets, which will be stored on the memory of the vulnerable BLE chip in the targeted device,” researchers explained.
“Next, the attacker sends the overflow packet, which is a standard advertising packet with a subtle alteration – a specific bit in its header turned ON instead of off. This bit causes the chip to allocate the information from the packet a much larger space than it really needs, triggering an overflow of critical memory in the process.”
It should be noted that the initial attack requires a hacker to be in the physical proximity of a targeted device, but once compromised, they can take control of the access point, allowing them to intercept network traffic, install persistent backdoor on the chip, or launch more attacks on other connected devices over the Internet.
Second BleedingBit OAD RCE Flaw in BLE Chips (CVE-2018-7080)
The second vulnerability, identified as CVE-2018-7080 , resides in CC2642R2, CC2640R2, CC2640, CC2650, CC2540, and CC2541 TI chips, and affects Aruba’s Wi-Fi access point Series 300.
This vulnerability stems from an issue with Texas Instruments’ firmware update feature in BLE chips called Over the Air firmware Download (OAD).
Since all Aruba access points share the same OAD password which can be “obtained by sniffing a legitimate update or by reverse-engineering Aruba’s BLE firmware,” an attacker can deliver a malicious update to the targeted access point and rewrite its operating system, gaining full control over the device.
“By default, the OAD feature is not automatically configured to address secure firmware updates. It allows a simple update mechanism of the firmware running on the BLE chip over a GATT transaction,” researchers explained.
“An attacker… can connect to the BLE chip on a vulnerable access point and upload a malicious firmware containing the attacker’s own code, effectively allowing a completely rewrite its operating system, thereby gaining full control over it,” the researchers said.
Patch Related Information
Armis discovered BleedingBit vulnerabilities earlier this year and responsibly reported all affected vendors in June 2018, and then also contacted and worked with affected companies to help them roll out appropriate updates to address the issues.
Texas Instruments confirmed the vulnerabilities and released security patches for affected hardware on Thursday that will be available through respective OEMs.
Cisco, which also owns Meraki, released BLE-STACK version 2.2.2 for three Aironet Series wireless access points (1542 AP, 1815 AP, 4800 AP), and Meraki series access points (MR33, MR30H, MR74, MR53E), on Thursday to address CVE-2018-16986.
Aruba has also released a security patch for its Aruba 3xx and IAP-3xx series access points to address the CVE-2018-7080 flaw.
However, both Cisco and Aruba noted that their devices have Bluetooth disabled by default. No vendor is aware of anyone actively exploiting any of these zero-day vulnerabilities in the wild.