Technology

59099 readers

3204 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

Are BLUFFS attacks still a vulnerability to the average Bluetooth user? (www.bluetooth.com)

submitted 10 months ago by Rebels_Droppin@lemmy.world to c/technology@lemmy.world

5 comments fedilink hide all child comments

I recalled reading about this at the beginning of this month, I haven't seen any updates on a fix or anything. Figured I'd ponder it with you folks over here.

I have since stopped using most of my Bluetooth devices as a precaution. How real of a threat is this vulnerability? Thanks and sorry if this kind of post is in the wrong spot.

top 5 comments

sorted by: hot top controversial new old

[–] BearOfaTime@lemm.ee 0 points 10 months ago* (last edited 10 months ago) (1 children)

Well, since I've not seen any updates to the BT stack, I'd go with yes.

Stopping using BT seems a bit extreme. What's your risk?

I only use BT for listening to music/podcasts. I never allow BT connections to have access to contacts, messages, etc. So the only risk (contacts/messages) is pretty well mitigated (for me). For someone who uses BT for contact sync, messages, calls, etc, there may be greater risk.

And IIRC, BLUFFS is a MITM risk (existing connection can be spoofed because of how a key is managed), so only connect to devices you control, don't allow random connections, leave BT off as much as is reasonable, and perhaps delete/recreate connections occasionally (I think the key gets regenerated on a new connection?).

The most someone would get from my BT is listening to my podcasts.

[–] Rebels_Droppin@lemmy.world 0 points 10 months ago (2 children)

Thanks for responding, I don't necessarily have any risk, but just didn't want to open myself up to anything since I didn't quite understand what information could be taken. Better safe than sorry approach you know?

But good to know that in being selective in permissions can mitigate some issues. I worry about a few family members who are not tech literate at all and use rail travel for work that puts them around people in masse and frivolously give permissions to their devices in different vehicles.

[–] BearOfaTime@lemm.ee 0 points 10 months ago (1 children)

Yea, "frivolous" is the part that's concerning. Perfect description of how average users approach tech. I'll be borrowing that!

Guess I need to write up something for family and friends, a good summary of BT risks and how to manage it. Sigh.

[–] squaresinger@feddit.de 0 points 10 months ago

If your family and friends are like most families and friends, even the best write-up will not help against the convenience of not having to press the Bluetooth icon on their phone before activating their headphones.

[–] squaresinger@feddit.de 0 points 10 months ago

Always know your threat scenarios. Depending on your threat scenario, pretty much anything could be a danger or completely harmless.

Bluetooth is a comparatively low-risk interface, since you hardly ever send anything really confidential over it, and since it's decentralized (only locallized communication), so an attacker needs to be within close range during the attack.

So what's the worst an attacker could do with Bluetooth? They could sniff the packages (mostly the audio that's being sent over Bluetooth or mouse clicks and keystrokes if you use a Bluetooth mouse or keyboard) or they could inject the same, e.g. to fake-type something on your devices.

So in reality, there's nothing special sent over Bluetooth (except maybe contact infos if you actively decide to share them with a Bluetooth device) and the attacker needs to stay within a few meters during the whole attack.

In almost all scenarios, even a completely unencrypted Bluetooth connection will only cause very limited potential trouble.