Bluetooth’s security vulnerability and how BlueID remains safe

16. October 2018

Munich, October 16, 2018 – In July 2018, researchers at the Israel Institute of Technology identified a security vulnerability in Bluetooth pairing features that allows a man-in-the-middle attack. If successful, the attacker could monitor, manipulate and forge the connection between the Bluetooth devices.

The research indicated that an attacker could intercept the public key exchange of two vulnerable Bluetooth devices going through a pairing process within wireless range. Without the validation of the public key, it could block each transmission and inject malicious packets. The gap was found in the Secure Simple Pairing and LE Secure Connections features, which are based on the Elliptic-Curve Diffie Hellman (ECDH). Bluetooth SIG standard used to recommend, but not require, that devices supporting these two features validate the public key while pairing, a fault which affected vendors such as Apple, Google and Intel.

Bluetooth SIG has stated that there is no evidence that the vulnerability has been exploited maliciously and has updated the Bluetooth specifications to finally require the validation of any public key received as part of public key-based security procedures. Even so, this remedy is only effective if users of the affected vendors update their devices.

So how can BlueID use Bluetooth and still promise security?

We keep our promise.

As a matter of fact, while these findings trembled most of the competition and their offerings, we remain firm in our most valuable expertise: secure connections.

Through the BlueID security system, a sophisticated asymmetrical certificate process based on a Public Key Infrastructure (PKI), we are able to offer secure authorization management over different mediums like Bluetooth and NFC.

So while we use Bluetooth as a channel, we do not rely on Bluetooth pairing or any other Bluetooth security feature. Rather, we rely on our own utmost security shield – an extra layer of safety, controlled and ensured by BlueID.

For more information on our independent security system, please visit https://www.blueid.net/technology/security/

 

Additional Technical Details

The research paper Breaking the Bluetooth Pairing – Fixed Coordinate Invalid Curve Attack by Eli Biham and Lion Neumann, which identified Bluetooth’s security vulnerability, can be found here

Bluetooth’s SIG Security Update addressing the matter can be found here