Bluetooth flaw leaves everyone vulnerable to KNOB attack

[Moltuae]

Article Link: https://www.trustedreviews.com/news...e-vulnerable-to-a-massive-knob-attack-3931162

The Bluetooth specification has been changed after security researchers discovered a vulnerability that enabled connections to be gatecrashed.

The Bluetooth SIG body acknowledged the possibility of Key Negotiation of Bluetooth, or KNOB, attacks, which could enable a bad actor to bypass the usual permissions protocol for pairing devices, which depends on both devices agreeing to the connection.

Waiting for the knob jokes ...

 

[Markverhyden]

It takes some effort to polish that.

 

[Porthos]

It takes some effort to polish that.

Coffee>spit.

 

[Diggs]

I'm not sure how big of deal this is considering how short bluetooth range is. You'd have to be staring the attacker in the face.

 

[Sky-Knight]

@Diggs, https://www.tomsguide.com/us/how-to-bluesniper-pt1,review-408.html

It's limited range is only in your mind... it's RF it can be exploited at any range as long as the other guy has the right equipment.

So... I guess that means we're now sniping knobs...

 

[Diggs]

It's limited range is only in your mind... i

I had no idea - Thanks!

Since so few people use bluetooth I'm wondering if I should start turning it off in Device Manager when doing new setups.

 

[Sky-Knight]

@Diggs, I don't do that because I don't like disabling expected functionality. But, I do train users that own enabled gear on the risks attached to it. It's really not anymore more or less risky than wifi already is. But it's indeed far from "secure".

 

[Markverhyden]

Vulnerabilities don't necessarily need bi-d communications.

Personally I always try to disable BT on mobile devices. Of course I discuss it with the EU so they understand the impact. Having BT always on will drain a battery since it's always polling. On old devices, especially smart devices this can make a difference.

 

[PcTek9]

Yep, there's a long range bluetooth hack device sold on the market. https://greatscottgadgets.com/hackrf/one/ and devices like the sena ud-100, ubertooth, nordic semiconductors nRF51-dk, and high end devices like the ellisys $17,500.00 usd bluetooth explorer...
PcTek9 puts a rainbow sticker on his knob vulnerability. LOL.