Background
On Sept. 12, 2017, Armis Labs announced newly discovered vulnerabilities in the Bluetooth implementations of Windows, Android, Linux, and iOS. These vulnerabilities were disclosed to the manufacturers in April 2017 and they have been working with Armis Labs on a coordinated announcement yesterday.
The complete list of vulnerabilities and corresponding CVE numbers are listed:
- Linux kernel RCE vulnerability - CVE-2017-1000251
- Linux Bluetooth stack (BlueZ) information Leak vulnerability - CVE-2017-1000250
- Android information Leak vulnerability - CVE-2017-0785
- Android RCE vulnerability #1 - CVE-2017-0781
- Android RCE vulnerability #2 - CVE-2017-0782
- The Bluetooth Pineapple in Android - Logical Flaw CVE-2017-0783
- The Bluetooth Pineapple in Windows - Logical Flaw CVE-2017-8628
- Apple Low Energy Audio Protocol RCE vulnerability - CVE-2017-14315
Impact
The impact varies between OS's to some degree, but demonstrated exploits have performed remote code execution on Android, Linux and iOS. Man-in-the-Middle (MITM) attacks have been demonstrated for Windows and Android. These attacks are successful without any user interaction or Bluetooth pairing.
The attacks are not detectable or preventable with traditional network security mechanisms. Currently, there are no known workarounds except to patch or turn off Bluetooth services.
Platforms affected
- Windows versions 7 and later that have not applied the July 2017 roll-up patches.
- All versions of Android without patches released on Sept. 9, 2017.
- All versions of Linux kernel 3.3-rc1 thru 4.13.1
- All iOS devices running versions of iOS prior to iOS 10.
Local observations
Currently, there are no known exploits in the wild for these vulnerabilities. However, UISO will continue to monitor threat intelligence sources for evidence of exploits in the wild.
UISO's recommendations
- Windows users should apply the July 2017 roll-up security patches if not already applied.
- Android users should check with their device manufacturers for recent security updates and apply as soon as possible.
- Linux administrators should apply security patches from their respective distribution vendors as the patches become available. RedHat and Ubuntu have already released patches.
- Upgrade iOS devices to version 10.
- Disable Bluetooth services on any unpatched devices until the appropriate patches/upgrades can be applied to the device.
UISO recommends as a general security principle that Bluetooth services be disabled on devices unless specifically required.
Workarounds
Disable Bluetooth services for unpatched devices.