Fresh Bluetooth Vulnerabilities Point to Underlying Concerns About Connected Device Security

Summary Bullets:

Amy Larsen DeCarlo – Principal Analyst, Security and Data Center Services

• Security researchers identified more than a dozen Bluetooth Classic stack vulnerabilities that affect at least 1,400 products

• This issue is highlighting broader cybersecurity challenges in the connected device world

Security researchers from Singapore University of Technology and Design cast a spotlight on vulnerabilities in 13 different Bluetooth chipsets that could put mobile and other connected devices at risk of breaches. Dubbed BrakTooth, with Brak being a Norwegian word for crash, the 16 identified vulnerabilities in the Bluetooth Classic stack can be exploited using a number of mechanisms including denial of service, firmware crashes, deadlocks, and arbitrary code execution (ACE). A wide range of devices from Dell laptops to consumer smart speakers and connected refrigerators could be vulnerable.

In a paper published on BrakTooth, researchers said at least 1,400 different products possess the vulnerabilities. At the date of publication, researchers noted 20 common vulnerability exposures (CVEs) have been verified. Four vulnerabilities are still waiting for confirmation from Intel and Qualcomm. Most of the vendors are still working on firmware patches to address the vulnerabilities. The University-affiliated research team is offering a BrakTooth proof-of-concept code to confirm the respective vendor’s stack is secure.

Industry watchers have long expressed concerns that security is more of an afterthought than an integral element with respect to connected devices. A report published in August by ORDR, a security vendor for connected devices, noted that 42% of deployed systems are agentless or un-agentable. The study sounded the alarm that many underprotected consumer devices including Pelotons, Sonos speakers, gaming consoles, and even Teslas are often connected to the corporate network making them an easy entry point for hackers. In the report, ORDR said 46% of all connected devices are vulnerable to a medium or high impact attack.

Many of the connected device security issues are glaring evidence about how overlooked basic protections are. Elements like out of date operating systems for medical devices or the high percentage (55%) of devices still connected to the network without an active user underscore the need for vendors and their clients alike to take a hard look at not just what embedded security connected device have but how they are deploying and managing them in production.