Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 up to and including 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
bluetooth bluetooth core specification |
||
microsoft windows 10 22h2 |
||
microsoft windows 11 21h2 |
||
microsoft windows 11 22h2 |
||
microsoft windows 11 23h2 |
||
microsoft windows server 2022 23h2 |
||
microsoft windows 10 21h2 |
||
microsoft windows 10 1809 |
||
microsoft windows server 2019 |
||
microsoft windows server 2022 |
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources BLUFFS spying flaw present in iPhones, ThinkPad, plenty of chipsets
Multiple Bluetooth chips from major vendors such as Qualcomm, Broadcom, Intel, and Apple are vulnerable to a pair of security flaws that allow a nearby miscreant to impersonate other devices and intercept data. The weaknesses were identified by Daniele Antonioli, an assistant professor at French graduate school and research center EURECOM's software and system security group. He detailed the attack vectors by which the flaws could be exploited in a paper [PDF] titled "BLUFFS: Bluetooth Forward a...
Vulmon