[论文解读] BLURtooth: Exploiting Cross-Transport Key Derivation in Bluetooth Classic and Bluetooth Low Energy

Daniele Antonioli, Nils Ole Tippenhauer+2 more|arXiv (Cornell University)|Sep 24, 2020

Bluetooth and Wireless Communication Technologies被引用 10

一句话总结

本文提出 BLURtooth，首次全面分析蓝牙中跨传输密钥衍生（CTKD）机制，发现四类关键的跨传输漏洞，允许符合标准的攻击，实现蓝牙经典设备与BLE设备之间的冒充、中间人攻击及未经授权的会话建立。这些攻击不受安全模式或配对方式影响，且已在14款搭载16种不同蓝牙芯片的设备上通过低成本实现方式成功验证。

ABSTRACT

The Bluetooth standard specifies two transports: Bluetooth Classic (BT) for high-throughput wireless services and Bluetooth Low Energy (BLE) for very low-power scenarios. BT and BLE have dedicated pairing protocols and devices have to pair over BT and BLE to use both securely. In 2014, the Bluetooth standard (v4.2) addressed this usability issue by introducing Cross-Transport Key Derivation (CTKD). CTKD allows establishing BT and BLE pairing keys just by pairing over one of the two transports. While CTKD crosses the security boundary between BT and BLE, little is known about the internals of CTKD and its security implications. In this work, we present the first complete description of CTKD obtained by merging the scattered information from the Bluetooth standard with the results from our reverse-engineering experiments. Then, we perform a security evaluation of CTKD and uncover four cross-transport issues in its specification. We leverage these issues to design four standard-compliant attacks on CTKD enabling new ways to exploit Bluetooth (e.g., exploiting BT and BLE by targeting only one of the two). Our attacks work even if the strongest security mechanism for BT and BLE are in place, including Numeric Comparison and Secure Connections. They allow to impersonate, man-in-the-middle, and establish unintended sessions with arbitrary devices. We refer to our attacks as BLUR attacks, as they blur the security boundary between BT and BLE. We provide a low-cost implementation of the BLUR attacks and we successfully evaluate them on 14 devices with 16 unique Bluetooth chips from popular vendors. We discuss the attacks' root causes and present effective countermeasures to fix them. We disclosed our findings and countermeasures to the Bluetooth SIG in May 2020 (CVE-2020-15802), and we reported additional unmitigated issues in May 2021.

研究动机与目标

• 逆向分析蓝牙经典与BLE中 CTKD 协议的行为，因标准中对此协议的文档描述不完整。
• 识别并分析 CTKD 中破坏蓝牙经典与BLE安全边界隔离性的跨传输安全问题（CTIs）。
• 设计并实现四种符合标准、持久存在的攻击（BLUR 攻击），利用 CTKD 实现冒充、中间人攻击及非预期会话建立。
• 验证这些攻击在多种蓝牙芯片及版本的真实设备上的可行性和影响范围。
• 提出并实验验证协议层的缓解措施，以修复所识别的漏洞。

提出的方法

• 通过分析来自多种蓝牙芯片（Broadcom、CSR、Cypress、Intel、Qualcomm）的真实设备数据包追踪，逆向推导 CTKD 行为。
• 通过将蓝牙标准规范与配对会话期间观察到的协议行为进行关联，映射 CTKD 密钥衍生过程。
• 设计跨传输攻击者模型，评估如何通过 CTKD 操控蓝牙经典与BLE密钥，重点关注密钥覆盖与角色不对称性。
• 设计四种符合标准的攻击（BLUR 攻击），分别利用四种不同的 CTIs：密钥覆盖、角色不对称、密钥分发缺陷及关联方法绕过。
• 使用现成硬件（如开发板）和开源蓝牙工具（如 BlueZ）实现低成本攻击框架，证明其在现实环境中的可行性。
• 在14台设备上评估攻击，涵盖16种不同的蓝牙芯片，包括支持蓝牙4.1至5.2的设备，并在所有安全模式（如安全连接、数字比较）下进行测试。

实验结果

研究问题

• RQ1 鉴于蓝牙标准中 CTKD 规范不完整，其内部实际工作机制是什么？
• RQ2 CTKD 如何破坏蓝牙经典与BLE之间的安全边界隔离，导致何种跨传输漏洞？
• RQ3 能否设计出符合标准、可在会话间持久存在的攻击，且无需攻击者在配对期间参与？
• RQ4 CTKD 缺陷的根本原因是什么，其如何导致跨传输的密钥覆盖与会话冒充？
• RQ5 能否设计并实验验证有效的协议层缓解措施，以修复所识别的漏洞？

主要发现

• 在 CTKD 中识别出四类关键的跨传输问题（CTIs）：密钥覆盖、角色不对称、密钥分发缺陷及关联方法绕过。
• BLUR 攻击是首个符合标准、持久存在的攻击，可在攻击者未参与配对过程时发起，实现跨蓝牙经典与BLE的长期冒充与中间人攻击。
• 这些攻击在各种安全模式（如安全连接）和配对方式（如数字比较）下均有效，即使在最强安全配置下也成立。
• 已在14台设备上成功演示攻击，涵盖16种不同蓝牙芯片，来自主流厂商，设备支持蓝牙4.1至5.2版本。
• 蓝牙 SIG 初期声称蓝牙5.1及以后版本不受影响，但经进一步分析，作者确认5.1和5.2设备仍存在漏洞。
• 通过在Linux笔记本上实验验证了一种协议层缓解措施——禁用密钥覆盖，证明其能有效缓解最严重的漏洞。