Key Takeaways
- Cov kws tshawb fawb siv qhov tsis muaj zog Bluetooth los qhib cov xauv ntse.
- Kev tawm tsam hla dhau qhov kev ntsuas kev nyab xeeb ntawm Bluetooth.
-
Cov kws tshaj lij hais tias qhov nyuaj ntawm kev tawm tsam ua rau nws tsis zoo li yuav siv los ntawm cov neeg ua phem phem.
Tus yuam sij tus tswv uas tuaj yeem qhib txhua lub Bluetooth ntse xauv lub suab nrov txaus ntshai. Qhov zoo, yog li ntawd, qhov kev xav txog tej yam zoo li no, txawm tias ua tau, yog qhov tsis tseem ceeb.
Cybersecurity research firm, NCC Group, tau pom qhov tsis muaj zog ntawm Bluetooth Low Energy (BLE) specification uas tuaj yeem siv los ntawm cov neeg tawm tsam los rhuav tshem cov xauv ntse, xws li ib qho siv hauv Tesla, thiab lwm lub xov tooj- raws li-ib-qhov tseem ceeb systems uas tso siab rau Bluetooth-raws li kev txheeb xyuas qhov tseeb. Hmoov zoo, cov kws tshaj lij hais tias qhov kev tawm tsam no tsis zoo li yuav tshwm sim ntawm qhov loj me, vim nws yuav siv ntau qhov kev ua haujlwm kom ua tiav.
"Qhov yooj yim ntawm kev taug kev mus txog ntawm ib lub tsev lossis lub tsheb thiab muaj lub qhov rooj qhib qhib tau meej thiab xav tau rau tib neeg feem coob," Evan Krueger, Tus Thawj Coj ntawm Engineering ntawm Token, hais rau Lifewire hauv email. "Tab sis tsim kom muaj lub kaw lus uas tsuas yog qhib rau tus neeg raug lossis tib neeg yog txoj haujlwm nyuaj."
Bluetooth Relay Attacks
Thaum cov kws tshawb fawb xa mus rau qhov kev siv los ua qhov tsis zoo ntawm Bluetooth, lawv tau lees paub tias nws tsis yog kab laum ib txwm tuaj yeem kho nrog software thaj, lossis qhov yuam kev hauv Bluetooth specification. Hloov chaw, lawv tau sib cav, nws tshwm sim los ntawm kev siv BLE rau lub hom phiaj uas nws tsis tau tsim los.
Krueger piav qhia tias feem ntau Bluetooth xauv cia siab rau qhov sib thooj, kwv yees tias qee qhov yuam sij lossis cov cuab yeej tso cai nyob rau hauv ib qho ntawm lub cev ntawm lub xauv txhawm rau tso cai nkag mus.
Ntau zaus, tus yuam sij yog ib yam khoom nrog lub xov tooj cua qis, thiab lub ntsuas phoo siv lub zog ntawm nws lub teeb liab ua qhov tseem ceeb hauv kev kwv yees tias nws nyob ze lossis deb npaum li cas. Krueger tau hais ntxiv tias ntau yam khoom siv tseem ceeb, xws li lub tsheb fob, tau tshaj tawm txhua lub sijhawm, tab sis lawv tsuas yog "tau hnov" los ntawm lub xauv thaum lawv nyob hauv qhov kev mloog.
Harman Singh, Tus Thawj Coj ntawm cybersecurity muab kev pabcuam Cyphere, tau hais tias qhov kev tawm tsam los ntawm cov kws tshawb fawb yog qhov hu ua Bluetooth relay nres, uas tus neeg tawm tsam siv lub cuab yeej los cuam tshuam thiab txuas kev sib txuas lus ntawm lub xauv thiab tus yuam sij.
"Bluetooth relay tawm tsam tuaj yeem ua tau vim tias ntau lub cuab yeej Bluetooth tsis tau txheeb xyuas tus kheej ntawm lub hauv paus ntawm cov lus, "Singh hais rau Lifewire hauv email pauv.
Krueger sib cav tias qhov kev tawm tsam relay yog qhov zoo sib xws rau cov neeg tawm tsam siv lub tshuab hluav taws xob kom nce qhov " nrov nrov" tus yuam sij tshaj tawm. Lawv siv nws los ntxias cov cuab yeej xauv kom xav tias tus yuam sij yog nyob ze thaum nws tsis yog.
"Qeb ntawm kev txawj ntse hauv kev tawm tsam zoo li qhov no ntau dua li qhov muab piv, tab sis lub tswv yim zoo ib yam," hais Krueger.
Nyob, Ua Tsaug
Will Dormann, Tus Kws Tshuaj Ntsuam Xyuas Qhov Tsis Txaus Siab ntawm CERT / CC, lees paub tias thaum NCC Group qhov kev siv tau zoo txaus siab, kev tawm tsam kom nkag mus rau hauv tsheb tsis tau hnov dua.
Singh pom zoo, ceeb toom tias muaj ntau qhov kev tshawb fawb thiab ua qauv qhia yav dhau los ntawm kev tawm tsam tawm tsam Bluetooth authentication. Cov no tau pab kom muaj kev ruaj ntseg ntawm kev sib txuas lus ntawm Bluetooth li los ntawm kev txhim kho kev tshawb nrhiav mechanisms thiab siv encryption, kom ua tiav kev thaiv kev tawm tsam.
Bluetooth relay tawm tsam tuaj yeem ua tau vim tias ntau lub cuab yeej bluetooth tsis lees paub tus kheej ntawm lub hauv paus ntawm cov lus.
Txawm li cas los xij, qhov tseem ceeb ntawm NCC Pawg kev siv dag zog yog tias nws tswj hwm kom dhau qhov kev txo qis ib txwm muaj, suav nrog kev nkag mus, piav qhia Singh. Nws hais ntxiv tias muaj cov neeg siv me me tuaj yeem ua dhau los ntawm kev paub txog qhov muaj peev xwm ntawm qhov kev tawm tsam no, vim nws yog lub luag haujlwm ntawm cov chaw tsim khoom thiab cov neeg muag khoom tom qab software kom ntseeg tau tias kev sib txuas lus Bluetooth tsis muaj pov thawj.
"Cov lus qhia rau cov neeg siv tseem zoo ib yam li nws tau ua dhau los; yog tias koj lub tsheb muaj qhov sib thooj-raws li kev qhib lub peev xwm tsis siv neeg, sim khaws cov khoom tseem ceeb ntawd tawm ntawm qhov chaw uas tus neeg tawm tsam yuav nyob," qhia Dormann. "Txawm nws yog ib qho tseem ceeb fob lossis lub xov tooj smartphone, tej zaum nws yuav tsum tsis txhob dai ze ntawm koj lub qhov rooj thaum koj pw."
Txawm li cas los xij, tsis txhob cia cov neeg tsim khoom ntawm cov kev daws teeb meem kev nyab xeeb no tawm ntawm tus nuv, Krueger ntxiv tias cov tuam txhab yuav tsum tau txav mus rau cov ntaub ntawv muaj txiaj ntsig zoo dua. Hais txog qhov piv txwv ntawm nws lub tuam txhab Token Nplhaib, Krueger tau hais tias qhov kev daws teeb meem yooj yim yog tsim qee yam ntawm cov neeg siv lub hom phiaj rau hauv cov txheej txheem qhib. Piv txwv li, lawv lub nplhaib, uas sib txuas lus hauv Bluetooth, tsuas yog pib tshaj tawm nws cov teeb liab thaum lub cuab yeej tus neeg hnav pib nws nrog kev taw qhia.
Qhov tau hais tias, txhawm rau pab ua kom peb lub siab yooj yim, Krueger ntxiv cov neeg yuav tsum tsis txhob txhawj xeeb txog cov Bluetooth no lossis lwm yam xov tooj cua-frequency key fobs exploits.
"Kev rub tawm qhov kev tawm tsam zoo li qhov tau piav qhia hauv Tesla ua qauv qhia yuav tsum muaj ob qho tib si qib tsis tseem ceeb ntawm kev ua haujlwm zoo thiab tus neeg tawm tsam yuav tsum tau tsom rau ib tus neeg tshwj xeeb," piav qhia Krueger. "[Qhov no txhais tau tias] tus tswv nruab nrab ntawm lub qhov rooj Bluetooth lossis lub tsheb kaw tsis zoo li yuav ntsib qhov kev tawm tsam no."
