ICT Security-Sécurité PC et Internet

Bluetooth-related vulnerabilities can affect a dizzying array of devices. In the latest instance, a newly discovered round of 12 Bluetooth bugs potentially exposes more than 480 devices to attack, including fitness trackers, smart locks, and dozens of medical tools and implants.

Researchers from Singapore University of Technology and Design began developing techniques for analyzing Wi-Fi security in January 2019, and later realized they could apply those same methods to assess Bluetooth as well. By September they had found their first bug in certain implementations of Bluetooth Low Energy, the version of the protocol designed for devices with limited resources and power. Within weeks, they had found 11 more.

Collectively dubbed "SweynTooth," the flaws exist not in BLE itself, but in the BLE software development kits that come with seven "system on a chip" products—microchips that integrate all of a computer's components in one place. IoT manufacturers often turn to off-the-shelf SoCs to develop new products quickly. That also means, though, that SoC implementation flaws can propagate across a wide variety of devices.

Learn more / En savoir plus / Mehr erfahren:

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Bluetooth

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=SweynTooth

Comme toutes les technologies, le Bluetooth n'échappe pas à son lot de vulnérabilités. Après la découverte par des chercheurs israëliens d'une faille CVE-2018-5383 pour intercepter ou endommager des données échangées entre terminaux, d'autres viennent d'être mises à nu. Trois chercheurs en technologie et design de l'université de Singapour, Matheus E. Garbelini, Sudipta Chattopadhyay et Chundong Wang, ont en effet trouvé une dizaine de failles relatives à la technologie Bluetooth Low Energy.

Regroupées sous le nom de SweynTooth, elles exposent une quinzaine de systèmes sur puce (SoC) de plusieurs fabricants qui y recourent : NXP, Cypress, Dialog Semiconductors, Microchip, STMicroelectronics et Telink Semiconductor. « Les vulnérabilités peuvent être utilisées par un attaquant qui se trouve dans le champ d'émission Bluetooth et peuvent faire planter les appareils concernés, forcer un redémarrage, les bloquer ou contourner le mode de couplage BLE sécurisé et accéder aux fonctions réservées aux utilisateurs autorisés », indique Bleepingcomputer.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?&tag=Bluetooth