Two critical vulnerabilities in Bluetooth Low Energy (BLE) Expose Millions of Devices to Remote Attacks


Security researchers have unveiled details of two critical vulnerabilities in Bluetooth Low Energy (BLE) chips embedded in millions of access points and networking devices used by enterprises around the world.

Dubbed BleedingBit, the set of two vulnerabilities could allow remote attackers to execute arbitrary code and take full control of vulnerable devices without authentication, including medical devices such as insulin pumps and pacemakers, as well as point-of-sales and IoT devices.

Discovered by researchers at Israeli security firm Armis, the vulnerabilities exist in Bluetooth Low Energy (BLE) Stack chips made by Texas Instruments (TI) that are being used by Cisco, Meraki, and Aruba in their enterprise line of products.

Armis is the same security firm that last year discovered BlueBorne, a set of nine zero-day Bluetooth-related flaws in Android, Windows, Linux and iOS that affected billions of devices, including smartphones, laptops, TVs, watches and automobile audio systems.

First BleedingBit RCE Vulnerability in BLE Chips (CVE-2018-16986)

The first vulnerability, identified as CVE-2018-16986, exists in TI chips CC2640 and CC2650 and affects many Cisco and Meraki’s Wi-Fi access points. The bug takes advantage of a loophole in the way Bluetooth chips analyze incoming data.

According to the researchers, sending more traffic to a BLE chip than it’s supposed to handle causes memory corruption, commonly known as a buffer overflow attack, which could allow an attacker to run malicious code on an affected device.

Attacks can remotely send multiple benign BLE broadcast messages, called “advertising packets,” which are stored on the memory of the vulnerable chip. As long as a target device’s BLE is turned on, these packets — which contain hidden malicious code to be invoked later on — can be used together with an overflow packet to trigger an overflow of critical memory.
If exploited, attackers are able to trigger memory corruption in the chip’s BLE stack, creating a scenario in which the threat actor is able to access an operating system and hijack devices, create a backdoor, and remotely execute malicious code.
“In the case of an access point, once the attacker gained control he can reach all networks served by it, regardless of any network segmentation,” Armis says. “Furthermore, the attacker can use the device in his control to spread laterally to any other device in its vicinity, launching a truly airborne attack.”
The TI chip versions below are vulnerable when scanning is used in either an observer role or central role:
  • CC2640 (non-R2) with BLE-STACK version 2.2.1 or earlier; or
  • CC2650 with BLE-STACK version 2.2.1 or earlier; or
  • CC2640R2 with BLE-STACK version 1.0 or earlier
Affected access points:
Cisco APs:
  • Cisco 1800i Aironet Access Points
  • Cisco 1810 Aironet Access Points
  • Cisco 1815i Aironet Access Points
  • Cisco 1815m Aironet Access Points
  • Cisco 1815w Aironet Access Points
  • Cisco 4800 Aironet Access Points
  • Cisco 1540 Aironet Series Outdoor Access Point
Meraki APs:
  • Meraki MR30H AP
  • Meraki MR33 AP
  • Meraki MR42E AP
  • Meraki MR53E AP

It should be noted that the initial attack requires a hacker to be in the physical proximity of a targeted device, but once compromised, they can take control of the access point, allowing them to intercept network traffic, install persistent backdoor on the chip, or launch more attacks on other connected devices over the Internet.

Second BleedingBit OAD RCE Flaw in BLE Chips (CVE-2018-7080)

The second vulnerability, identified as CVE-2018-7080​, resides in CC2642R2, CC2640R2, CC2640, CC2650, CC2540, and CC2541 TI chips, and affects Aruba’s Wi-Fi access point Series 300.

This vulnerability stems from an issue with Texas Instruments’ firmware update feature in BLE chips called Over the Air firmware Download (OAD).

Since all Aruba access points share the same OAD password which can be “obtained by sniffing a legitimate update or by reverse-engineering Aruba’s BLE firmware,” an attacker can deliver a malicious update to the targeted access point and rewrite its operating system, gaining full control over the device.

“By default, the OAD feature is not automatically configured to address secure firmware updates. It allows a simple update mechanism of the firmware running on the BLE chip over a GATT transaction,” researchers explained.

“An attacker… can connect to the BLE chip on a vulnerable access point and upload a malicious firmware containing the attacker’s own code, effectively allowing a completely rewrite its operating system, thereby gaining full control over it,” the researchers said.


Patch Related Information

Armis discovered BleedingBit vulnerabilities earlier this year and responsibly reported all affected vendors in June 2018, and then also contacted and worked with affected companies to help them roll out appropriate updates to address the issues.

Texas Instruments confirmed the vulnerabilities and released security patches for affected hardware on Thursday that will be available through respective OEMs.

Cisco, which also owns Merakireleased BLE-STACK version 2.2.2 for three Aironet Series wireless access points (1542 AP, 1815 AP, 4800 AP), and Meraki series access points (MR33, MR30H, MR74, MR53E), on Thursday to address CVE-2018-16986.

Aruba has also released a security patch for its Aruba 3xx and IAP-3xx series access points to address the CVE-2018-7080​ flaw.

However, both Cisco and Aruba noted that their devices have Bluetooth disabled by default. No vendor is aware of anyone actively exploiting any of these zero-day vulnerabilities in the wild.


Please enter your comment!
Please enter your name here

Questo sito usa Akismet per ridurre lo spam. Scopri come i tuoi dati vengono elaborati.