SWEYNTOOTH Bluetooth Flaw Affects IoT Devices to Security Systems
It’s difficult to imagine the modern workplace without wireless technology.
It wasn’t that long ago when everything was connected with wires: phones, internet, headsets… Nowadays, that’s all handled by LTE, WiFi, and, of course, Bluetooth.
Bluetooth technology has revolutionized the world of consumer electronics. It’s found in countless products, including speakers, headphones, smart home devices, and even medical devices. With its “pairing” security, it’s generally considered to be a secure, borderline foolproof method of connecting your devices using minimal energy. However, like with all wireless technologies, there are always exploits that could put you and your business at risk.
What is SweynTooth?
In January of 2019, a group of researchers from Singapore University of Technology and Design started looking into security vulnerabilities in WiFi security. Soon after, they discovered the same methods could also be used to analyze the security of Bluetooth devices as well.
Within just a few weeks, they found their first security bug in some implementations of Bluetooth Low Energy. This is a Bluetooth protocol specifically designed for devices that have limited resources, such as power consumption. One exploit is scary enough, but they soon discovered 11 more of them.
These exploits were collectively named “SweynTooth,” and their discovered showed that almost 500 different consumer devices were vulnerable to attack. That list includes IoT devices, home security and monitoring tools, and even scarier, potentially life-saving devices, such as heart monitors, pacemakers, and blue glucose monitors.
The SoC manufacturers that are impacted by SweynTooth include NXP, Cypress, Dialog Semiconductors, STMicroelectronics, Texas Instruments, and Telink Semiconductor.
What Could Someone Do With SweynTooth?
The beauty (and weakness) of Bluetooth devices is that they have a limited range. That means someone within a device’s radio range (1,312 ft or 400 m) could use one or more of the exploits to take over an affected Bluetooth device. At that point, they could turn off the device, disable the BLE connection until restarted, or even entirely bypass the BLE pairing, giving them full access.
The Good News
You will probably find it a huge relief that these security exploits are limited to specific Bluetooth Low Energy software development kits, rather than a problem with the BLE protocol itself. This limits the number of devices that could be impacted by SweynTooth.
These software development kits come with several “system-on-a-chip” Bluetooth products. Many manufacturers use these SoCs for their IoT commercial products, saving on manufacturing time and cost.
Thankfully, the impacted manufacturers have started to release patches for these devices that fix the vulnerabilities for newly manufactured products. However, as Bluetooth devices can’t be wirelessly updated automatically through the internet, the burden is on the end-user to make sure their specific device is affected, then patch it.
What You Can Do
First, it’s important to check and see if you have any devices that are impacted by the SweynTooth vulnerabilities. You should also make sure that any future purchases that use the BLE protocol were manufactured after the patches were implemented.
If you discover your security devices, either at home or in a corporate environment, could be affected by these vulnerabilities, you must update them with their released patch as soon as possible. If there is not a patch available for that device yet, stop using it until one is released. We cannot overstate the danger of vulnerabilities like this, on both a personal and business level.
Unfortunately, there will always be new security vulnerabilities discovered in wireless and traditional technologies. That’s why it’s imperative you keep on top of all digital security news to make sure the devices you use every day are secured from attacks.
To keep updated on the latest in digital security, you can subscribe to ComSec LLC’s blog. Watching out for possible threats is our job, and we take it very seriously.
And, if you are concerned that your home or business have been targeted by electronic eavesdroppers, we invite you to check out our expert Cyber TSCM Services, or contact us today to learn more about how we can restore your privacy.
About the Author:
J.D. LeaSure, CCISM, is the President / CEO of ComSec LLC, a global provider of world class counterespionage and TSCM / Cyber TSCM™ services. www.ComSecLLc.com