Bluetooth Impersonation Attacks (BIAS)
Original Issue Date: May 20, 2020
Severity Rating: Medium
- All Bluetooth devices supporting BR/EDR Core Configurations version 5.2 and prior
A vulnerability has been reported in Bluetooth protocol, which could be exploited by an adjacent attacker to perform a spoofing attack(BIAS) impersonating the address of a previously paired remote device.
Bluetooth Basic Rate / Enhanced Data Rate (BR/EDR) Core Configurations are used for low-power short-range communications. To establish an encrypted connection, two Bluetooth devices must pair with each other using a link key.
An attacker with physical access to the Bluetooth connection could perform a spoofing attack impersonating the address of a previously paired remote device. This attack may result in the attacking device completing the authentication procedure successfully despite not possessing the link key.
This vulnerability in turn, could permit an attacker to initiate the Bluetooth Key Negotiation (KNOB) attack more efficiently, potentially gaining full access as the remote paired device.
It is highly recommended that the end users apply the latest update.
Bluetooth host and controller suppliers should refer to the Bluetooth SIG for guidance on updating their products.
The information provided herein is on "as is" basis, without warranty of any kind.
Email: email@example.com Phone: +91-11-24368572
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
6, CGO Complex, Lodhi Road,
New Delhi - 110 003