Is Your Bluetooth Chip Leaking Secrets via RF Signals?

https://www.semanticscholar.org/paper/Is-Your-Bluetooth-Chip-Leaking-Secrets-via-RF-Ji-Dubrova/c1d3ceb47ea6f9cc4f29929e2f97d36862a260a2

84•transpute•10h ago

Comments

vardump•8h ago

A side channel attack revealing AES key from just 90,000 traces.

Sigh, side channel attacks seem to be everywhere now.

sitzkrieg•8h ago

people are finally aware everything leaks, it's just a matter of how closely you look

boulevard•8h ago

Everything leaks if you stare at it long enough

formerly_proven•8h ago

There's a lot of signal left between you and the noise floor!

namibj•7h ago

Worse: noise floor is a matter of definition.

czbond•7h ago

Everything has data exhaust.... the exhaust type just differs.

barbegal•8h ago

That 90,000 traces did take 225 hours to capture so it is truly a huge amount of data and not a trivial attack.

karlgkk•7h ago

On the other hand, I’d argue that it’s close enough to trivial to be considered trivial. How many embedded devices transmit sensitive information?

Now, I know that pretty much every Bluetooth based credit card reading device explicitly defends against a channel such as this, but there are tons of access control solutions, and medical devices that don’t

Would you notice a raspberry pi tucked into the mess of wires beneath the security guard guards desk?

throwaway89201•6h ago

> How many embedded devices transmit sensitive information?

Every Zigbee device uses AES keys to secure the network, although the security of the protocol is pretty weak in most deployments, especially when new devices join the network. Leaking the network key would provide access to the entire network. The ARM Cortex-M4 is often used, which the side-channel attack in the article is about.

kragen•58m ago

That's less than two weeks.

3abiton•7h ago

I read the abstract, while not familiar with the topic, how would we go about limiting the inpact?

Retr0id•6h ago

Rotating keys frequently would probably help. But the best thing to do is use implementations that are less leaky in the first place (which is easier said than done).

ryukoposting•5h ago

As someone who finally recently escaped bluetooth firmware development: yes, Bluetooth is leaking secrets and it doesn't even require any silly RF shenanigans. Almost nothing actually implements LESC. Apple refuses to implement OOB pairing, so no peripherals can force you to use it, so everything is subject to MITM attacks. The entire ecosystem is a mess of consultants and underpaid devs copy-pasting Nordic sample code, with no time or financial incentive to do more than the bare minumum. Never trust any product that moves sensitive data through Bluetooth.

matthewdgreen•4h ago

Apple claims to have implemented an entire second security level for their Bluetooth apps based on iMessage, but I trust it not at all.

(To be clear, I trust the iMessage protocol with reasonable confidence. I judge the probability that Apple has applied this extra layer of security uniformly to all sensitive data to be about 8%.)

cozzyd•2h ago

Text written with a non-apple Bluetooth keyboard is green?

ggm•19m ago

8.75% surely? you need at least two digits of specious precision on that non-random number.

SXX•1h ago

Just curious if it that insecure how does Magic Keyboard with Touch ID works? Does it use some apple proprietary "magic"?

makeitdouble•1h ago

> "magic"

They're on an proprietary extension of Bluetooth, standard compatible but closed to their devices. They usually don't talk much about it, Phil Schiller was the most explicit I think (it was about the airpod's W1 but it's the same deal)

https://www.theverge.com/2016/9/7/12829190/apple-w1-chip-iph...

> Apple’s Phil Schiller described Apple’s move to a new wireless chip as “fixing the challenges” of wireless audio

Verdex•4h ago

Time for everyone to implement some variation of https://www.bluetooth.com/specifications/specs/authorization... ?

Simple trick to increase coverage: Lying to users about signal strength

Facts about throwing good parties

Oxy is Cloudflare's Rust-based next generation proxy framework

Paris had a moving sidewalk in 1900, and a Thomas Edison film captured it (2020)

Using FreeBSD to make self-hosting fun again

When models manipulate manifolds: The geometry of a counting task

Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody

Why don't you use dependent types?

Tongyi DeepResearch – open-source 30B MoE Model that rivals OpenAI DeepResearch

How the Mayans were able to accurately predict solar eclipses for centuries

Lisp: Notes on its Past and Future (1980)

Terahertz Tech Sets Stage for "Wireless Wired" Chips

URLs are state containers

Reproducing the AWS Outage Race Condition with a Model Checker

Why does Swiss cheese have holes?

Collatz-Weyl Generators: Pseudorandom Number Generators (2023)

Notes by djb on using Fil-C

X.org Security Advisory: multiple security issues X.Org X server and Xwayland

Is Your Bluetooth Chip Leaking Secrets via RF Signals?

FurtherAI (Series A – A16Z, YC) Is Hiring Across Software and AI

Solar-powered QR reading postboxes being rolled out across UK

Syllabi – Open-source agentic AI with tools, RAG, and multi-channel deploy

The x86 Interrupt List, aka “Ralf Brown's Interrupt List” (2018)

Autodesk's John Walker Explained HP and IBM in 1991 (2015)

Backpropagation is a leaky abstraction (2016)

Anti-cybercrime laws are being weaponized to repress journalism

At the end you use `git bisect`

I ****Ing Hate Science (2021)

Scents of Arabia: Interdisciplinary approaches to ancient olfactory worlds

Writing FreeDOS Programs in C

Simple trick to increase coverage: Lying to users about signal strength

Facts about throwing good parties

Oxy is Cloudflare's Rust-based next generation proxy framework

Paris had a moving sidewalk in 1900, and a Thomas Edison film captured it (2020)

Using FreeBSD to make self-hosting fun again

When models manipulate manifolds: The geometry of a counting task

Alleged Jabber Zeus Coder 'MrICQ' in U.S. Custody

Why don't you use dependent types?

Tongyi DeepResearch – open-source 30B MoE Model that rivals OpenAI DeepResearch

How the Mayans were able to accurately predict solar eclipses for centuries

Lisp: Notes on its Past and Future (1980)

Terahertz Tech Sets Stage for "Wireless Wired" Chips

URLs are state containers

Reproducing the AWS Outage Race Condition with a Model Checker

Why does Swiss cheese have holes?

Collatz-Weyl Generators: Pseudorandom Number Generators (2023)

Notes by djb on using Fil-C

X.org Security Advisory: multiple security issues X.Org X server and Xwayland

Is Your Bluetooth Chip Leaking Secrets via RF Signals?

FurtherAI (Series A – A16Z, YC) Is Hiring Across Software and AI

Solar-powered QR reading postboxes being rolled out across UK

Syllabi – Open-source agentic AI with tools, RAG, and multi-channel deploy

The x86 Interrupt List, aka “Ralf Brown's Interrupt List” (2018)

Autodesk's John Walker Explained HP and IBM in 1991 (2015)

Backpropagation is a leaky abstraction (2016)

Anti-cybercrime laws are being weaponized to repress journalism

At the end you use `git bisect`

I ****Ing Hate Science (2021)

Scents of Arabia: Interdisciplinary approaches to ancient olfactory worlds

Writing FreeDOS Programs in C

Is Your Bluetooth Chip Leaking Secrets via RF Signals?

Comments