• @theit8514
    link
    English
    71
    edit-2
    3 months ago

    I mean it was not too long ago there was a bug which could lead to an unauthenticated RCE against Bluetooth on Android.

    https://nvd.nist.gov/vuln/detail/CVE-2022-20345

    So yea, reducing surface area of attack when a feature is not needed is kinda important.

    • mesamune
      link
      English
      193 months ago

      When we do defcon, Bluetooth is one of the easiest protocols to take control of. It’s funny. It’s also easy to spoof, easy to mess with, and generally very insecure.

      • ɐɥO
        link
        fedilink
        English
        53 months ago

        was at 37c3 and people were constantly spamming BLE pairing requests lmao

      • @sqibkw
        link
        English
        23 months ago

        I’m curious, what about Bluetooth makes it insecure? Is it that vendors create insecure implementations, like Android, or is it a human issue like connecting to things by default? I recall the Bluetooth spec being unbelievably complex and verbose, which obviously increases risk and makes it harder to audit, but it doesn’t get many updates, and I don’t recall seeing many issues with the spec itself. I mean it’s not like it’s fixing a CVE every quarter like with netty packages.

        • @[email protected]
          link
          fedilink
          English
          43 months ago

          It’s too complicated. Bluetooth is complicated. It tries to do way too much, and not even the experts can implement it in a consistent fashion because different Bluetooth stacks are forced to make assumptions where the specification is unclear.

          When you have a large, complex, and poorly designed specification, you’re going to get bugs. The main limiting factor has been the short range of Bluetooth preventing widespread exploitation.

        • mesamune
          link
          English
          23 months ago

          Its more complex than I can talk about here in any kind of depth, but it comes down to it being a very old protocol. It has known security issues that are just not fixed as it would break backwards compatibility with a lot of devices. So the same issues that were chosen to not be fixed are still out there. You can, with very little effort, take control of just about any Bluetooth device(or partial). Or at least knock it out if commission.