[论文解读] A Study of the Feasibility of Co-located App Attacks against BLE and a Large-Scale Analysis of the Current Application-Layer Security Landscape

Pallavi Sivakumaran, J. Blasco|arXiv (Cornell University)|Aug 11, 2018

Bluetooth and Wireless Communication Technologies被引用 9

一句话总结

本文表明，共置的 Android 应用程序可绕过 BLE 配对保护机制，在用户不知情的情况下访问 BLE 外设上的敏感数据，即使权限极少亦可实现。研究发现，超过 45% 的分析 BLE 应用程序缺乏应用层加密，其中 70% 的医疗类应用程序存在漏洞，并提出了 BLECryptracer 工具以大规模检测此类缺陷。

ABSTRACT

Bluetooth Low Energy (BLE) is a fast-growing wireless technology with a large number of potential use cases, particularly in the IoT domain. Increasingly, these use cases require the storage of sensitive user data or critical device controls on the BLE device, as well as the access of this data by an augmentative mobile application. Uncontrolled access to such data could violate user privacy, cause a device to malfunction, or even endanger lives. The BLE standard provides security mechanisms such as pairing and bonding to protect sensitive data such that only authenticated devices can access it. In this paper we show how unauthorized co-located Android applications can access pairing-protected BLE data, without the user's knowledge. We discuss mitigation strategies in terms of the various stakeholders involved in this ecosystem, and argue that at present, the only possible option for securing BLE data is for BLE developers to implement remedial measures in the form of application-layer security between the BLE device and the Android application. We introduce BLECryptracer, a tool for identifying the presence of such application-layer security, and present the results of a large-scale static analysis over 18,900+ BLE-enabled Android applications. Our findings indicate that over 45% of these applications do not implement measures to protect BLE data, and that cryptography is sometimes applied incorrectly in those that do. This implies that a potentially large number of corresponding BLE peripheral devices are vulnerable to unauthorized data access.

研究动机与目标

• 调查共置的 Android 应用程序在 BLE 设备已通过配对和绑定保护的情况下，是否可行实现未经授权的数据访问。
• 评估 BLE 适配的 Android 应用程序中应用层安全机制的普遍程度。
• 识别声称保护 BLE 数据的应用程序中密码学误用和实现缺陷的情况。
• 为开发人员、操作系统供应商和平台利益相关方提出缓解策略。
• 通过基于应用下载量的统计分析，估算此类攻击在现实世界中的影响范围。

提出的方法

• 开发了 BLECryptracer，一种静态分析工具，用于检测 BLE 数据流中的应用层安全机制。
• 对从公开应用仓库提取的 18,929 个 BLE 适配的 Android APK 文件进行了大规模静态分析。
• 使用 Amandroid 进行污点分析，追踪 BLE GATT 特性中的敏感数据流向加密函数。
• 将应用程序分类（如医疗、健身等），以评估漏洞在不同应用领域中的分布情况。
• 分析密码学模式，检测诸如硬编码密钥和弱加密模式等不安全实践。
• 通过基准测试和与现有工具的对比验证结果，确保其可靠性。

实验结果

研究问题

• RQ1 当另一台授权应用已与外设配对时，未经授权的 Android 应用程序是否仍可访问受配对保护的 BLE 数据？
• RQ2 在 BLE 适配的 Android 应用程序中，采用基于密码学的应用层安全机制的比例是多少？
• RQ3 在声称保护 BLE 数据的应用程序中，密码学误用（如硬编码密钥或使用不安全的加密模式）的普遍程度如何？
• RQ4 Android 的权限模型（v6+）对这类攻击的隐蔽性和可行性有何影响？
• RQ5 基于应用下载统计数据和分析结果，估计有多少 BLE 设备可能因缺少或损坏的应用层安全机制而面临未经授权的数据访问风险？

主要发现

• 在分析的 18,929 个 BLE 适配的 Android 应用程序中，超过 45% 未为 BLE 数据实施任何基于密码学的应用层安全机制。
• 在医疗类应用程序中，未实施应用层安全机制的比例上升至约 70%，表明健康类物联网设备存在严重风险。
• 在实施密码学机制的应用程序中，15% 存在误用模式，如硬编码密钥或使用 ECB 等不安全的加密模式。
• 未经授权的应用程序可使用少于授权应用程序的权限访问受保护的 BLE 数据，使此类攻击更具隐蔽性和欺骗性。
• 分析表明，由于缺少或损坏的应用层安全机制，可能有数十万计的 BLE 设备面临未经授权的数据访问风险。
• 本研究证实，由于共置漏洞的存在，当前的 BLE 安全机制在 Android 上仍显不足，而应用层安全机制目前是唯一可行的防御手段。