Ezinsukwini ezimbalwa ezedlule, Abaphenyi abavela eFederal Polytechnic School of Lausanne bakhishwe ukuthi bakhombe ukuba sengozini kwezindlela zokwenza umdlalo amadivayisi ahlangabezana nokujwayelekile Bluetooth Okwakudala (i-Bluetooth BR / EDR).
Ukuba sengozini yi-BIAS enekhodi nenkinga ivumela umhlaseli ukuthi ahlele ukuxhumeka kwedivayisi yakhe eyimbumbulu esikhundleni sedivayisi kusuka kumsebenzisi ongene ngemvume ngaphambilini nokudlulisa ngempumelelo inqubo yokuqinisekisa ngaphandle kokwazi ukhiye wesiteshi (ukhiye wesixhumanisi) owenziwe ngesikhathi sokubhanqa kokuqala kwamadivayisi nokuvumela ngaphandle kokuphinda inqubo yokuqinisekisa yesandla ekuxhumekeni ngakunye.
Ingqikithi yendlela ukuthi uma uxhuma kumadivayisi asekela imodi Yokuxhuma Okuvikelekile, i- umhlaseli umemezela ukungabi bikho kwale modi bese ebuyela ekusebenziseni indlela ephelelwe yisikhathi yokufakazela ubuqiniso (imodi "ezuzwe njengefa"). Kumodi "yefa", umhlaseli uqala ushintsho lwendima yesigqila esiyinhloko, futhi ethula idivayisi yakhe njenge "master", ethatha inqubo yokuqinisekisa. Ngemuva kwalokho umhlaseli uthumela isaziso mayelana nokuqedwa ngempumelelo kokufakazela ubuqiniso, ngaphandle kokuba nokhiye wesiteshi, futhi idivayisi iyaziqinisekisa ngakolunye uhlangothi.
I-Bluetooth Spoofing Attack (i-BIAS) ingenziwa ngezindlela ezimbili ezihlukene, kuya ngokuthi iyiphi indlela elula yokubhanqa okuvikelekile (noma ngabe i-Legacy Secure Connections noma i-Secure Connections) eyayikade isetshenziswa ukuqala ukuxhumana phakathi kwamadivayisi amabili. Uma inqubo yokubhangqa iqediwe kusetshenziswa indlela yokuxhumana okuvikelekile, umhlaseli angasho ukuthi iyithuluzi elikude elibhanqiwe ngaphambilini elingasasekeli ukuxhumana okuphephile, kunciphisa ukuphepha kokufakazela ubuqiniso.
Ngemuva kwalokho, umhlaseli angaphumelela ekusebenziseni ukhiye wokubethela omfushane kakhulu, equkethe kuphela i-1 byte ye-entropy futhi usebenzise ukuhlaselwa kweKNOB okwenziwe ngaphambilini ngabaphenyi abafanayo ukusungula ukuxhumeka kwe-Bluetooth okubethelwe ngaphansi kwesisetshenziswa sedivayisi esemthethweni (uma ngabe idivayisi ivikelekile ekuhlaselweni yi-KNOB futhi usayizi wokhiye awukwazanga ukuncishiswa, umhlaseli ngeke akwazi ukusungula isiteshi sokuxhumana esibethelwe, kepha izoqhubeka nokuqinisekiswa kumsingathi).
Ngokuxhashazwa okuphumelelayo sengozini, idivayisi yomhlaseli idinga ukuba sebangeni ledivayisi ye-Bluetooth esengozini kanye nomhlaseli kufanele unqume ikheli ledivayisi ekude lapho uxhumano lwenziwe khona ngaphambilini.
Abaphenyi bashicilele ikhithi yamathuluzi esebenzisa indlela ehlongozwayo yokuhlasela futhi bakhombisa ukuthi bangakuthinta kanjani ukuxhuma kwe-smartphone ye-Pixel 2 ebhangqwe phambilini besebenzisa ilaptop ye-Linux kanye nekhadi le-Bluetooth le-CYW920819.
Indlela ye-BIAS ingenziwa ngenxa yalezi zizathu ezilandelayo: ukusungulwa koxhumano oluphephile i-Bluetooth ayibetheli futhi ukukhethwa kwendlela yokuxhumanisa evikelekile akusebenzi ukubhangqwa osekuvele kumisiwe, ukusungulwa koxhumano oluphephile lwe-Legacy Secure Connections ayidingi ukufakazelana ubuqiniso bobabili, idivaysi ye-Bluetooth ingenza ushintsho lwendima nganoma yisiphi isikhathi ngemuva kosesho lwe-baseband, futhi amadivayisi abhanqwe ne-Secure Connections angasebenzisa i-Legacy Secure Connections ngenkathi esungula ukuxhumana okuphephile.
Inkinga idalwa ukukhubazeka kwenkumbulo futhi izibonakalisa ngezitaki eziningi ze-Bluetooth kanye ne-firmware yamachips we-Bluetooth, kufaka phakathi i-Intel, Broadcom, i-Cypress Semiconductor, i-Qualcomm, i-Apple ne-Samsung Amathokheni asetshenziswa kuma-Smartphones, ama-laptops, amakhompyutha asebhodi eyodwa, kanye nezinto ezikhiqizwa kubakhiqizi abahlukahlukene.
Abaphenyi bahlole imishini engama-30 (I-Apple iPhone / iPad / MacBook, Samsung Galaxy, LG, Motorola, Philips, Google Pixel / Nexus, Nokia, Lenovo ThinkPad, HP ProBook, Raspberry Pi 3B +, njll.), Ezisebenzisa ama-chips ahlukene angama-28, futhi zazisa abakhiqizi ngobungozi ngoDisemba odlule. Akukacaci okwamanje ukuthi yimuphi kubakhiqizi okhiphe izibuyekezo ze-firmware ngesisombululo.
Ngokunikezwe lokhu, inhlangano iBluetooth SIG obhekele ukuthuthukiswa kwamazinga we-Bluetooth umemezele ukuthuthukiswa kwesibuyekezo esichazwe ku-Bluetooth Core. Umagazini omusha uzichaza ngokusobala izimo lapho ukushintshwa kwendima yesigqila esiyinhloko kuvunyelwe, kunesidingo esiyisibopho sokuqinisekisa bobabili lapho ubuyela kumodi "yefa", futhi kunconywa ukuhlola uhlobo lokubethela ukugwema ukwehla kokuvikelwa kokuxhumeka izinga.
Umthombo: https://www.kb.cert.org