Mazuva mashoma apfuura, Vanotsvaga kubva kuFederal Polytechnic Chikoro cheLausanne vakaburitswa kuti vakaziva kusagadzikana munzira dzekufananidza zvishandiso zvinosangana neyakajairwa MAKARALI USB Yakasarudzika (Bluetooth BR / EDR).
Iyo njodzi iri codenamed BIAS uye dambudziko inobvumira uyo anorwisa kuronga kubatana kwechinhu chake chenhema panzvimbo pechigadzirwa kubva kune akambopinda mushandisi uye nekubudirira kupfuudza nzira yekusimbisa usingazive kiyi kiyi (yekubatanidza kiyi) inogadzirwa panguva yekutanga pairing yemidziyo uye uchibvumira pasina kudzokorora manyore yekusimbisa maitiro pane yega yega kubatana.
Musimboti wenzira yacho ndeyekuti kana iwe uchibatanidza kumidziyo inotsigira Yakachengeteka Maitiro ekubatanidza, iyo anorwisa anozivisa kusavapo kweiyi mode uye anodzokera kune yechinyakare nzira yekusimbisa ("nhaka" maitiro). Mune "nhaka" maitiro, anorwisa anotangisa tenzi-muranda basa shanduko, uye achiratidza mudziyo wake sa "tenzi", anotora nzira yekusimbisa. Ipapo anorwisa anotumira chiziviso nezve kupedzwa kwekubudirira kwechokwadi, asina kana kiyi kiyi, uye chishandiso chinozvisimbisa kune rumwe rutivi.
Iyo Bluetooth Spoofing Attack (BIAS) inogona kuitwa nenzira mbiri dzakasiyana, zvinoenderana nekuti ndeipi Yakachengeteka Nyore Pairing nzira (ingave Nhaka Yakachengeteka Konji kana Yakachengeteka Konji) yaimboshandiswa kumisikidza kubatana pakati pemidziyo miviri. Kana nzira yekubatanidza ikapedzwa uchishandisa iyo Yakachengeteka maConnection nzira, anorwisa anogona kutaura kuti ndicho chakambotakurwa kure mudziyo usingachatsigire zvakachengeteka kubatana, zvichideredza chokwadi chechengetedzo.
Mushure meizvozvo, anorwisa anogona kubudirira pakushandisa ipfupi kiyi yekunyorera, iine chete 1 byte ye entropy uye shandisa iyo KNOB kurwisa kwakagadzirwa kare nevatsvakurudzi vamwechete kuti vatange kubatana kwakachengetedzwa kweBluetooth pasi pechiyeuchidzo chechigadzirwa chepamutemo (kana chishandiso ichi chakadzivirirwa pakurwiswa kweKNOB uye saizi yakakosha haina kutapudzwa, anorwisa haazokwanise kumisikidza nzira yakavharidzirwa yekutaurirana, asi ichaenderera ichisimbiswa kumushandi).
Zvekubudirira kubiridzira yekukuvadzwa, mudziyo wemurwisi unofanirwa kuve uri mukati meiyo isinganetsi Bluetooth kadhi uye anorwisa iwe unofanirwa kuona kero yeiyo kifaa chiri kure iko iko kubatana kwaimboitwa kare.
Vatsvagiridzi vakaburitsa prototype toolkit vachishandisa nzira yakarongwa yekurwisa uye vakaratidza maitiro ekuparadza kubatana kweyaimbove yakabatanidzwa Pixel 2 smartphone uchishandisa Laptop yeLinux uye CYW920819 Bluetooth kadhi.
Iyo nzira yeBIAS inogona kuitirwa nekuda kwezvikonzero zvinotevera: kumisikidzwa kwechengetedzo yekubatanidza Bluetooth haina kunyorwa uye kusarudzwa kwenzvimbo dzakabatana dzekubatanidza nzira hakushandise pairing yakatosimbiswa, kumisikidzwa kwekuchengetedzwa kwakabatana kweNhaka Kuchengetedzwa Kwekubatana hazvidi kubvumirana, mutero weBluetooth unogona kuita shanduko yebasa chero nguva mushure mekutsvaga kwebaseband, uye zvishandiso zvakavezwa pamwe neCecurity Connections zvinogona kushandisa Legacy Secure Connections apo ichitanga kubatana kwakachengeteka.
Dambudziko rinokonzerwa nekukanganisa ndangariro uye kunozviratidza mune akawanda maBluetooth makeke uye iyo firmware yeyeBluetooth machipisi, kusanganisira Intel, Broadcom, Cypress Semiconductor, Qualcomm, Apple uye Samsung Zviratidzo zvinoshandiswa mumafoni, laptops, single-board board, uye zvigadzirwa kubva kune vakasiyana vagadziri.
Vatsvakurudzi vakaedza zvishandiso makumi matatu (Apple iPhone / iPad / MacBook, Samsung Galaxy, LG, Motorola, Philips, Google Pixel / Nexus, Nokia, Lenovo ThinkPad, HP ProBook, Raspberry Pi 3B +, nezvimwewo), izvo zvinoshandisa makumi maviri nemasere machipisi, uye vanozivisa vagadziri vekushupika. Zvita apfuura. Izvo hazvisati zvatsanangurwa kuti ndeupi wevagadziri aburitsa zvigadzirwa zve firmware nemhinduro.
Tichifunga izvi, sangano reBluetooth SIG inoona nezve kusimudzira kweBluetooth zviyero yakazivisa kuvandudzwa kweyekuvandudzwa kune iyo Bluetooth Core kutaurwa. Shanduro nyowani inotsanangura zvakajeka kesi umo tenzi-muranda wekushandura chinobvumidzwa, pane chinosungirwa chinodiwa chekutendeseka kwechokwadi kana uchidzokera ku'nhaka 'maitiro, uye zvinokurudzirwa kutarisa rudzi rwekunyorera kudzivirira kuderera kwekubatana dziviriro chikamu.
mabviro: https://www.kb.cert.org