New Bluetooth vulnerability affects billions of devices

Daniele Antonioli, an expert at the Eurecom Research Institute (France), has discovered a series of unknown security weaknesses in BLUFFS (Bluetooth Forward and Future Secrecy) technology. These vulnerabilities are related to the way of obtaining the Bluetooth session key to decrypt data exchanged between two devices.

BLUFFS affects devices using Bluetooth versions from 4.2, released in December 2014, to 5.4, released in February. Researchers found six BLUFFS attacks, each using different device impersonation or man-in-the-middle attacks.

The above methods are effective even if the user's device is equipped with the latest Bluetooth security features, due to the vulnerability related to the basic architecture of Bluetooth. Therefore, billions of devices from tablets, laptops, smartphones to Bluetooth headsets are at risk of attack.

After receiving Eurecom's report, Bluetooth SIG, the non-profit organization that oversees the development and is responsible for licensing Bluetooth, issued a warning and advised users to reject connections that do not meet the key requirements.

For mobile devices, users should regularly update software. More importantly, they should turn off Bluetooth when not in use to reduce the risk of being attacked, as well as be cautious about paired devices, not agreeing to pair with unknown sources.