Researchers find security flaws in thousands of Bluetooth devices

16 vulnerabilities in Bluetooth protocols have been uncovered by researchers from Singapore University of Technology and Design (SUTD). In addition to causing a denial of service, the vulnerabilities can cause devices to crash and audio equipment to become unresponsive as well.

There were thirteen distinct Bluetooth devices with Bluetooth chips from dozens of various manufacturers, including Intel and Qualcomm, that were tested by the researchers.

Bluetooth version numbers ranged from 3.0 to 5.2, with 5.2 being the most recent. They uncovered sixteen new vulnerabilities, as well as twenty previously known flaws, according to the researchers. There were several devices that did not perform in accordance with the Bluetooth standard's standards and specifications.

The researchers were able to achieve arbitrary code execution on smart home devices that were running on the affected chips as a result of the vulnerabilities. A denial of service assault on laptops and cellphones, as well as the freezing of Bluetooth audio devices, were also possible.. According to the experts, these flaws are present in at least 1,400 different goods on the market.

"The vulnerabilities exist as a result of certain specifications of the standard, as well as the accompanying protocols, not being followed," the researchers explain. In order to safeguard yourself, researchers are currently recommending that you utilize Bluetooth in public places. "A potential hacker would have to be within range of the Bluetooth antenna in order to carry out attacks because the vulnerabilities are in the Bluetooth Classic protocol. When utilizing Bluetooth, it is essential that you remain alert of your surroundings "It has a certain ring to it. The researchers also advised that you examine the list of impacted chips and that you apply the fixes as soon as they are made available by the manufacturers.

The use of Bluetooth on these devices should be minimized to the greatest extent possible if the patches are not available or not given by the device manufacturers. The researchers rely on a proof of concept that will be published on October 20 in order to be completely certain that the vulnerabilities are present on a device. More information will be made available at that time.

It was reported to the chip manufacturers – including Intel, Qualcomm, Texas Instruments, Infineon, Espressif, Bluetrum Technology and Silicon Labs – who were all notified of the 16 vulnerabilities. According to reports, updates have already been released by Bluetrum Technology, Espressif, and Infineon. Some vulnerabilities are being investigated by Intel, Qualcomm, Actions, and Zhuhai Jieli Technology, according to reports. According to the researchers, Harman International and SiLabs, two manufacturers, have not commented as of the time of the publishing of their findings.