Bleedingbit zero-day chip flaws may expose majority of enterprises to remote code execution attacks

[bernorange 8363]

Quote

Bleedingbit is a set of two new zero-day vulnerabilities which have the potential to expose enterprise firms to remote code execution attacks worldwide.

On Thursday, researchers from enterprise security firm Armis revealed the bugs, which together impact Bluetooth Low-Energy (BLE) chips used in millions of Cisco, Meraki, and Aruba wireless access points (APs).

Developed by Texas Instruments (TI), the vulnerable BLE chips are used by roughly 70 to 80 percent of business wireless access points today by way of Cisco, Meraki and Aruba products.

"Because businesses rely on them for mission-critical communications, a compromise at this level can give attackers deep access into enterprise networks," Armis says.

...

More:  https://www.zdnet.com/article/new-bleedingbit-zero-day-vulnerabilities-impact-majority-of-enterprises-at-the-chip-level/

So apparently Bluetooth can be compromised.

[Macanudo 13012]

17 minutes ago, bernorange said:

So apparently Bluetooth can be compromised. 

And you thought it woudn't be?

[Doc Holliday 199]

Bluetooth has been compromised for years just like many other frequencies that are picked up by cell phones, computers, etc.   Think your Bluetooth is turned off? Nope.  Oh that FM radio chip that all the phones have, yeah that's been hacked too and leveraged as a pivot point just like bluetooth.  I'm surprised more hasn't come out of this with IoT being such a big thing now. 

[crash_davis 23115]

china and world governments love bluetooth.  easy way to spread viruses and malware.   this and blueborne are only what is discovered.  no doubt all governments and hackers have a toolbox of bt malware and exploits. 

 

we are all freely turning over our privacy and deluding ourselves that privacy matters.  this includes companies.  like with everyone else, i've traded convenience and information for privacy.  but i use vpn, so my delusion is intact.  cognitive dissonance is a wonderful thing.

[Doc Holliday 199]

2 minutes ago, crash_davis said:

china and world governments love bluetooth.  easy way to spread viruses and malware.   this and blueborne are only what is discovered.  no doubt all governments and hackers have a toolbox of bt malware and exploits. 

 

we are all freely turning over our privacy and deluding ourselves that privacy matters.  this includes companies.  like with everyone else, i've traded convenience and information for privacy.  but i use vpn, so my delusion is intact.  cognitive dissonance is a wonderful thing.

depends on the VPN and they do deter malicious activity - however - I bet there is a tool-kit out there for exploits especially with quantum computing becoming more of a reliable thing

[clapclapclap 9000]

1 hour ago, crash_davis said:

china and world governments love bluetooth.  easy way to spread viruses and malware.   this and blueborne are only what is discovered.  no doubt all governments and hackers have a toolbox of bt malware and exploits. 

Bleedingoutofsomewherebit and Bluebalz, too.

[Newdoc 3453]

I’m upgrading to this bad boy. Unhackable according to the ebay description.

[crash_davis 23115]

Theodore J. Kaczynski was a man ahead of his time.

[GSU&UT 1798]

2 hours ago, Doc Holliday said:

depends on the VPN and they do deter malicious activity - however - I bet there is a tool-kit out there for exploits especially with quantum computing becoming more of a reliable thing

You can set one up on an EC2 instance in AWS pretty easily. That is what I use just so I can have a static IP if I'm not at home/office for our security group settings in our cloud infrastructure.