Bluetooth Vulnerability Could Allow Threat Actors to Overwrite Authentication Keys

Summary

Researchers identified a vulnerability in the Cross-Transport Key Derivation (CTKD), a standard used for pairing and encryption, in devices that support Bluetooth BR/EDR and LE versions 4.0 through 5.0. The vulnerability, dubbed BLURtooth, can be exploited by threat actors to manipulate the CTKD and overwrite Bluetooth authentication keys and downgrade to weak encryption key strength, which can facilitate Man-in-the-Middle (MITM) attacks. Patches are not immediately available; however, Bluetooth SIG provides recommendations for mitigating the vulnerability in their Security Notice.

Recommendations

The NJCCIC recommends reviewing the details of the vulnerability in the CERT/CC Vulnerability Note VU#589825 and implement the recommendations provided in the Bluetooth SIG Security Notice. Additionally, apply patches when they become available.