New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points
November 2 2018Wi-Fi access points and other devices using Bluetooth Low Energy (BLE) chips made by Texas Instruments contain vulnerabilities that could allow an attacker to take control of the wireless network.
The vulnerable TI chips are used in Wi-Fi access points made by Aruba, Cisco, and Meraki — vendors that together account for nearly 70% of the enterprise WiFi access point (AP) market.
Researchers at Armis, an IoT security firm, found two new, separate vulnerabilities in TI CC2640/50 and TI cc2540/1 chips. Dubbed “BleedingBit” by the researchers, the vulnerabilities allow exploits in two different attacks.
Ben Seri, vice president of research at Armis, says the first vulnerability, CVE-2018-16986, is an overflow in the field that stores “advertising packets” sent by devices in the AP’s area to let the AP know that the device is there.
“It’s supposed to be six bits, but these chips look at two additional bits that are supposed to be zero,” Seri says. If an attacker sends a number of well-formed advertising packets containing code, and then a malformed packet with a “one” in either of those two extra bit places, it results in a stack overflow that could allow execution of all that earlier-delivered code.
What kind of code could be delivered? One possibility is a backdoor that would allow the attacker complete access to the device. At that point, “The attack can move from the BLE chip to the rest of the network,” Seri says.
The second vulnerability, CVE-2018-7080, affects only Aruba APs, but can deliver larger payload in a single step. Aruba included an over-the-air download (OAD) feature through BLE as a tool for use in the development process. When that feature is left active in a production system, an attacker can obtain the hardcoded password and use the feature to completely rewrite the AP’s operating system.
The true problem with both of these vulnerabilities, says Seri, is, “There’s nothing looking at BLE as an attack vector. No one considers this a risk surface, so it’s a complete blind spot from an organizational perspective.”
Seri and Armis security researcher Dor Zusman will discuss their chip findings on in detail in the session “BLEEDINGBIT: Your APs Belong to Us” at Black Hat Europe, December 3 – 6.
Both Cisco and Aruba have issued security bulletins covering the vulnerabilities. Seri says that other devices outside the parameters of this research may well have used the vulnerable devices, and might be exploitable with serious consequences.
Because of its position within the systems where it’s employed, the BLE chip can provide a very powerful point of entry for an attacker.”In your smartwatch and home control, the BLE chip can be the only chip on the system,” Seri says. “An insulin pump might have only the BLE chip, so gaining access to the chip automatically gives full control over the device.”
Related Content:
- New Report: IoT Now Top Internet Attack Target
- 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
- 4 Trends Giving CISOs Sleepless Nights
- ‘Torii’ Breaks New Ground For IoT Malware
Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.
Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio
New Bluetooth Vulnerabilities Exposed in Aruba, Cisco, Meraki Access Points
November 2 2018Wi-Fi access points and other devices using Bluetooth Low Energy (BLE) chips made by Texas Instruments contain vulnerabilities that could allow an attacker to take control of the wireless network.
The vulnerable TI chips are used in Wi-Fi access points made by Aruba, Cisco, and Meraki — vendors that together account for nearly 70% of the enterprise WiFi access point (AP) market.
Researchers at Armis, an IoT security firm, found two new, separate vulnerabilities in TI CC2640/50 and TI cc2540/1 chips. Dubbed “BleedingBit” by the researchers, the vulnerabilities allow exploits in two different attacks.
Ben Seri, vice president of research at Armis, says the first vulnerability, CVE-2018-16986, is an overflow in the field that stores “advertising packets” sent by devices in the AP’s area to let the AP know that the device is there.
“It’s supposed to be six bits, but these chips look at two additional bits that are supposed to be zero,” Seri says. If an attacker sends a number of well-formed advertising packets containing code, and then a malformed packet with a “one” in either of those two extra bit places, it results in a stack overflow that could allow execution of all that earlier-delivered code.
What kind of code could be delivered? One possibility is a backdoor that would allow the attacker complete access to the device. At that point, “The attack can move from the BLE chip to the rest of the network,” Seri says.
The second vulnerability, CVE-2018-7080, affects only Aruba APs, but can deliver larger payload in a single step. Aruba included an over-the-air download (OAD) feature through BLE as a tool for use in the development process. When that feature is left active in a production system, an attacker can obtain the hardcoded password and use the feature to completely rewrite the AP’s operating system.
The true problem with both of these vulnerabilities, says Seri, is, “There’s nothing looking at BLE as an attack vector. No one considers this a risk surface, so it’s a complete blind spot from an organizational perspective.”
Seri and Armis security researcher Dor Zusman will discuss their chip findings on in detail in the session “BLEEDINGBIT: Your APs Belong to Us” at Black Hat Europe, December 3 – 6.
Both Cisco and Aruba have issued security bulletins covering the vulnerabilities. Seri says that other devices outside the parameters of this research may well have used the vulnerable devices, and might be exploitable with serious consequences.
Because of its position within the systems where it’s employed, the BLE chip can provide a very powerful point of entry for an attacker.”In your smartwatch and home control, the BLE chip can be the only chip on the system,” Seri says. “An insulin pump might have only the BLE chip, so gaining access to the chip automatically gives full control over the device.”
Related Content:
- New Report: IoT Now Top Internet Attack Target
- 100,000-Plus Home Routers Hijacked in Campaign to Steal Banking Credentials
- 4 Trends Giving CISOs Sleepless Nights
- ‘Torii’ Breaks New Ground For IoT Malware
Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.
Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio