Critical Bluetooth vulnerability in Android

[TekMol]

That's heavy. There are tons of phones out there that will never be patched again.

The situation on the phone market is so miserable.

The industry forces us to throw away perfectly fine hardware after just 3 years or so.

[kop316]

Yep. Even Google's own devices that are not supported anymore will permanently be vulnerable to this:

https://developers.google.com/android/images

I have a Pixel C that will never have an official patch to this exploit. I wonder if this is a user space exploit too, and if so, that would mean there's no technical reason for why they can't update it.

[rjmunro]

In the UK I always wonder if it's possible to bring a claim under Part 1 Chapter 2 of the Consumer Rights Act 2015. The goods must be 'satisfactory'. Remove code execution over bluetooth is not satisfactory, even if it only became apparent 3 years later.

https://www.moneysavingexpert.com/shopping/consumer-rights-r...

[madez]

The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alternatives, and we all vote with our wallets.

[dspillett]

At least there is the mitigation that it isn't exploitable unless the device is scanning for new devices to pair with, at least by my reading of the reports I've seen.

Phones are not usually in that state unless the BT settings screen is open. Otherwise it would drain excess battery in normal use.

[ChrisCinelli]

> That's heavy

Almost every month there are security patches for "critical" problems. Just skim throught the blog pages. This is Jan 2020 for example: https://source.android.com/security/bulletin/2020-01-01

Consider this: if I remember correctly somebody on HN was saying that in these days the average time from releasing a patch and exploit found in the wild is 4 days.

Consider that the patches hit the open source code a lot before they are deployed.

Consider that beside Google, any other Android phone manufacturer take around a month before releasing the patches even on current models.

The situation has no easy solutions.

[DangerousPie]

FWIW, the situation is significantly better in the Apple phone market.

[shadowgovt]

> The industry forces us to throw away perfectly fine hardware after just 3 years or so.

Possibly because of things like this; when a vulnerability isn't going to get patched, churn (with new hardware running newest OS) protects the ecosystem against mass-compromise.

We can bemoan the lack of patches, but who's paying for the patches?

[neilsimp1]

My current phone (Samsung Note 5) is too old to receive updates and I'm still on Android 7. I hardly use Bluetooth but I'm still a little upset.

[ChrisCinelli]

I agree with you that it is a shame that perfectly working hardware is left highly insecure after just 3 years (that is actually worse for some other manufacturers).

The worst part is that people keep using the phones because are not tech savvy or grossly underway the risk and they do not feel that they need to spend money on a new phone.

[loeg]

You can shorten 3 years to 1.5 for typical Android vendors (i.e., Samsung) and maybe extend it to 4 or 5 years for Apple. There is a marked difference in the two ecosystems' approach to support for older hardware.

[32gbsd]

this, hardware has become a the ugly ducklin to software.

[xtat]

mobile is the tire fire that keeps on giving

[m1r3k]

My OnePlus 3 phone just got its last security patch and is now out of support from the manufacturer.

I use bluetooth constantly for my smartwatch and headphones.

I think it's time for custom firmware just because of this. Goodby banking apps and Google Pay, because apparently a newer but unofficial OS is more insecure [1].

[1] https://developer.android.com/training/safetynet

[guimoz]

You can usually still pass safetynet with latest magisk, even on custom Roms. Go check the xda forums and you might find that.

[tjoff]

> Only enable Bluetooth if strictly necessary. Keep in mind that most Bluetooth enabled headphones also support wired analog audio.

Reason #4373 that ditching the headphone jack is pure insanity.

Sigh.

[maxerickson]

I bet it's not particularly true that most bluetooth headphones support wired analog audio. It may have been a few years ago, not now that the most prominent use case is phones.

[rorykoehler]

Don't buy a headphone jackless phone. I haven't and won't ever. I will stop using a phone before I use a jackless one.

[gchokov]

I haven’t missed the jack for a single day.

[AdmiralAsshat]

I quickly realized the value of the headphone jack the last time I had to turn my device to Airplane mode and realized I couldn't listen to any music on the plane using my wireless earbuds.

Fortunately, my aging GS8+ still has a headphone jack, and I had a pair of analog headphones in my travel bag.

[mavhc]

Why haven't most of the billions of Android phones been hacked already? Most never get updates and seems like there's 100 ways to hack them.

[anotheryou]

I think phones are also relatively hardened so the attack surfaces are not super convenient.

Bluetooth: get in reach of an attacker (and from another comment: have your device searching for bluetooth devices)

Web-stuff: if a patched browser doesn't help you are still relatively safe browsing all the non-infecting websites in the world.

file-stuff: you have to be stupid enough to open files, on your phone, from phishy mails (unless you are targeted they are always suspiciously generic, even when spreading from a hacked acquaintance )

I guess if there was a vulnerability where you could remotely gain full control over a phone without any action on the phone side you'd indeed have phone botnets. Looks like there are no such vulnerabilities.

Take what I write with a grain of salt, I'm actually just a noob trying to make sense of this, too.

[wmeredith]

The same reason that a billion minnows swimming together is safer than 5. There are a billion targets and few few of them are worth hacking.

[microcolonel]

Gotta say, having worked with the Android Bluetooth stack, I'd be surprised if there weren't lots of serious issues like this. The handling of pointers in there is often both clever and not helpful.

[billpg]

"We could roll out the patches, or we could make all our customers buy new phones!"

Stagefright again.

[aedron]

So some questions:

> with the privileges of the Bluetooth daemon

Which priviliges is that? Can it access user data? Snoop on input/output?

> For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address

So if wifi is off, I'm safe?

I have bluetooth on all the time, because it automatically pairs with my car for cellular and audio, and turning it on and off would be a hassle. I rarely, however, use wifi unless I have to download a very big amount of data, which is almost never.

[joelthelion]

On the plus side, could this be used to root phones?

[nickcw]

> As soon as we are confident that patches have reached the end users, we will publish a technical report on this vulnerability including a description of the exploit as well as Proof of Concept code.

It is likely to be a long time to never for most Android phones to receive patches for this :-(

[2T1Qka0rEiPr]

> Keep in mind that most Bluetooth enabled headphones also support wired analog audio.

Is this true?

[lima]

Actual headphones, yes - many of them have an analog jack.

But I haven't ever seen a bluetooth headset that support analog audio.

[lathiat]

I would say the reverse is true. There is absolutely a subset that support this but I doubt most is close.

[tushar-r]

Headphones, yep. Earphones? Mostly no.

[FraKtus]

Am I right to understand that this vulnerability only works when Bluetooth is in discoverable mode?

If yes, then most phones are safe even if they have this vulnerability, it's only when you go in the Bluetooth menu that you are at risk...

[beatgammit]

It's exactly this type of reason that I'm excited for the Librem 5 and PinePhone. I don't use many apps, and I value security updates, so using a community supported phone based on standard Linux sounds a lot more appealing to me than getting another Android phone. My current phone is an Android One device and so should still be getting updates, so hopefully I can stay reasonably secure until those phones are usable as replacements.

[dmatech]

I hate to say it, but it seems like only a large-scale worm outbreak that gets media coverage would be enough to fix the utterly broken Android patching landscape. From the description, this appears wormable (especially in crowds and possibly in vehicles). And unlike other wormable vulnerabilities that go through a service (like Google or even the phone company), this is just two phones with no intermediary to protect devices.

[photon-torpedo]

> only the Bluetooth MAC address of the target devices has to be known

Android has a feature of "Bluetooth scanning" to improve device location (similar to Wifi scanning). I'm not sure, but even if Bluetooth is disabled in the menu, this might still activate Bluetooth occasionally and perhaps reveal the Bluetooth MAC to the (nearby) world?

[dspillett]

IIRC that doesn't enable BT if disabled, only uses it if available.

[zepto]

Surprising that Project Zero didn’t catch this.

[magicalhippo]

> For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address.

Which ones would that be? Anyone know?

[butz]

Great, because of limited Android updates I have to get a new phone.

[gaius_baltar]

I'm now wondering if I can use this to root my phone.

[Brave-Steak]

> Keep your device non-discoverable. Most are only discoverable if you enter the Bluetooth scanning menu. Nevertheless, some older phones might be discoverable permanently.

Does this mean your MAC address isn't visible while on, non-discoverable and connected to a BT device?

[baybal2]

Actually Android keep bluetooth on even when UI says off for Google to radiolocate your position.

[cpncrunch]

Is there a way to make it non-discoverable? I don't see that option on my Nexus 6P running 8.1. You can just turn bluetooth on or off.

Or is it just discoverable when you click "pair new device"?