The BIAS bug allows attacks on these providers: Cypress, Qualcomm, Apple, Intel, Samsung and CSR.
Official Article
As we are aware that Bluetooth is the most common means of wireless technology used in our daily life. From transferring files to transferring bits of other information such as audio / video. We are very much dependent on the Bluetooth technology. But a group of researchers have claimed to find a rather serious Bluetooth bug. This Bluetooth bug allows attackers to do some serious M.I.T.M attack.
A group of academic researchers have discovered a bug that exploits Bluetooth Classic ( a.k.a Bluetooth BR / EDR ) protocol. This protocol is used to transfer data between low powered devices. These devices may include but not limited to Wireless headsets to Smartphones, Smarbands to Smartphones, Laptops to Laptop, etc.
Watch the video below to see how an attacker might gain an advantage. The video is explained to you by the group of researchers.
Also learn about : Strandhogg 2.0: Android bug that can trick user and steal data
Tech Enum
Can attackers target my device ?
The researchers targeted more than 28 devices. The results of the exploit was a success each time. This bug is rooted in the Bluetooth specification itself. Hence, allowing the attacker to target any of the un-patched devices.
This bug was discovered back in December 2019. The researchers notified the Bluetooth vendors about the issue. So the chances are the vendors might have already pushed bug-fixes to devices. Or at least have pushed a work around for this issue.
Therefore, the answer is it depends on what the device manufacturer did with the vulnerability patching.
Situation at the moment
Bluetooth SIG has stated that “to prevent BIAS attackers from downgrading the Bluetooth Classic protocol from a secure authentication method to a legacy authentication mode where the BIAS attack is successful.”
” To remedy this vulnerability, the Bluetooth SIG is updating the Bluetooth Core Specification to clarify when role switches are permitted, to require mutual authentication in legacy authentication, and to recommend checks for encryption-type to avoid a downgrade of secure connections to legacy encryption. These changes will be introduced into a future specification revision ”
