Two New Bluetooth Chip Flaw Expose Millions of Devices to Remote Attacks. Security researchers have found another flaw in Bluetooth Low Energy (BLE) chips embedded in many devices including health-related devices such as pacemakers as well. The vulnerability allows the attacker to not only gain access to the system but also to other devices connected to it. Discovered by researchers at Israeli security firm Armis, the vulnerabilities exist in Bluetooth Low Energy (BLE) Stack chips made by Texas Instruments (TI) that are being used by Cisco, Meraki, and Aruba in their enterprise line of products. The first vulnerability, identified as CVE-2018-16986, exists in TI chips CC2640 and CC2650 and affects many Cisco and Meraki’s Wi-Fi access points. The bug takes advantage of a loophole in the way Bluetooth chips analyze incoming data.
According to the researchers, sending more traffic to a BLE chip than it’s supposed to handle causes memory corruption, commonly known as a buffer overflow attack, which could allow an attacker to run malicious code on an affected device. Although, initiating an attack at first requires in hand or nearby access to the device. But, once the attack is initiated, the code can also hack into the connected router, which makes the device vulnerable and accessible from anywhere in the world.
Armis discovered BleedingBit vulnerabilities earlier this year and responsibly reported all affected vendors in June 2018, and then also contacted and worked with affected companies to help them roll out appropriate updates to address the issues.
Texas Instruments confirmed the vulnerabilities and released security patches for affected hardware on Thursday that will be available through respective OEMs.
Also read – WiFi Gets A New Simplified Name Version WiFi 6.
Comment below if you have anything to discuss this topic. Follow us on Facebook, Twitter, Instagram or Linkedin.