Hello world,
16 New Bluetooth vulnerabilities have been discovered, some of which allow an attacker
to hack into and remotely control a device.
And it turns out our android and iOS phones aren’t alone in susceptibility to malware.
A new report shows basic phones are also on hackers’ hit lists.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news.
16 Brand new vulnerabilities in Bluetooth have been discovered which not only allow
an attacker to crash a device’s bluetooth functionality in a Denial of service attack,
but more worryingly one of these exploits enables arbitrary code execution, meaning
an attacker could remotely control a vulnerable device via its bluetooth connection. Potentially
billions of devices are affected by these newly discovered hacks
Researchers from the “Singapore University of Technology and Design” are behind a comprehensive
new paper on these vulnerabilities. They’ve dubbed the new hacks “BrakTooth”. “Brak”
is Norwegian for “crash” - it does sound kinda cool - but I would have expected them
to go with a more local language, Norway is quite far.
The vulnerabilities range in their severity, the less severe ones are Denial of service
attacks. These affect a whole array of devices, everything
from smartphones and laptops to keyboards, toys and even industrial equipment. They’ve
discovered quite a few of these exploits, but let's look at the one which affects the
device you’re likely watching this on. “Laptops and smartphones employing” certain Intel
and Qualcomm bluetooth chipsets are affected. The phones affected seem to be rather niche
Chinese brands, however an array of Microsoft surface laptops also use one of the vulnerable
bluetooth SoCs.
The paper explains that the denial of service attack works because the bluetooth SoC or
“system on chip” doesn’t properly free resources when it receives certain types of
packets. “The attacker can exhaust the SoC” by spamming “malformed packets” until
the bluetooth module nopes out “triggering firmware crashes”. This is demonstrated
in a video they made where they attacked a bluetooth speaker - audio through the speaker
starts stuttering and eventually disconnects. I suppose you could call this a kind of deauth
attack for bluetooth. Annoying? Yes, but it’s not going to ruin a victim’s day.
The arbitrary code execution vulnerability is a little more than mildly annoying however,
it’s “the most critical vulnerability” they discovered and if utilised correctly
most definitely has the potential to ruin your day. This exploit specifically affects
esp32 chips. The electronics hobbyists among my audience will recognise this chip. It’s
a super powerful little thing. Sporting dual cores, it’s the goto chip for any project
that needs WiFi and bluetooth functionality, it’s famous in the electronics hobbyist
world. And due to its incredibly low cost - after all the thing is only $3 in a module
- it’s used in a bunch of IOT appliances, LED bulbs, smart home stuff, that kind of
thing.
The arbitrary code execution vulnerability allows attackers to do such things as erase
VRAM, toggle WiFi and bluetooth, as well as control GPIO. The GPIO on the esp32 are the
data lines it uses to communicate with connected components. So for example in a smart bulb
the GPIO will control the LEDs; a hacker messing with your lights isn’t much concern, unless
you’re epileptic. But more worryingly, in a product, such as a smart lock, a servo used
for the locking mechanism could be actuated. Again, a proof of concept video illustrates
this, they hack into an esp32 and toggle an LED. Ironically all these attacks are themselves
carried out by esp32 chips.
As far as we know none of these vulnerabilities have been exploited in the wild as of yet.
The researchers have of course created proof of concept tools which would allow you to
recreate these attacks, however they’re only provided upon request. And for now they’re
only being made available to manufacturers until November, giving them time to create
patches until the exploits inevitably make their way into the hands of wrong doers.
In the unlikely event you’re interested in dissecting the flow diagrams for each of
the new vulnerabilities, I’ll make sure to link the full research paper in the description.
I’ve covered mobile phone related malware quite a bit on this channel. Whenever the
topic of mobile malware or pegasus spyware comes up, I’ve noticed a recurring meme
in the comments that we might as well head “back to flip phones” - because that’s
the only safe option at this point, or is it? It turns out that there’s nowhere to
hide, as a new paper from a Russian researcher has analysed an array of low cost phones,
and found that “a considerable number of simple push-button phones” contain… and
he’s putting it mildly here “unwanted undocumented functions.”
Far from being immune from malware, 4 of the 5 random phones that were sampled were found
to come with modified firmware which steals money from the phone’s owner. This new research
specifically covers phones of this kind sold on Russian online marketplaces, the report
itself is in Russian, which I've had translated.
The impetus for this investigation was numerous reports on Russian news websites and in product
reviews about some low cost phones somehow adding random charges to their owners’ monthly
phone bills. Wanting to dig deeper, Valdik, the researcher, bought 5 mobiles ranging in
cost from 10 to 20 dollars.
He conducted his analysis by analyzing the phones’ firmware and constructing a DIY
“2G base station” to intercept communications. The contraption, consisting of a blade RF,
raspberry pi 400 and specialist software revealed how the scam worked. Upon booting up the phones
they would phone home to a miscreant controlled server, initially only reporting metadata
about the device, essentially letting whoever runs this scheme know that yet another mobile
has been added to their list. Some phones did this via the internet, others via SMS.
Later on the phones would be instructed by the command and control server to secretly
send premium rate text messages. These are text messages sent to a special kind of number
which directly charges the mobile phone bill. They’re often used by charities to accept
donations, or to enter competitions for a fee, that kind of thing. In this intercepted
POST request, a phone is told to text a number, and send 50 rubles - that’s roughly 70 cents
- to a premium number. An excerpt from a Russian news site shares a similar story of a victim
who bought the exact same phone and “was debited 50 rubles.”
50 rubles or 70 cents doesn’t sound like much, but this would be done periodically
- with a new charge every few weeks, idea being the victim wouldn’t notice such a
small charge on their bill - and let’s be honest, who actually reads their phone bill?
However over time and with a number of malicious mobiles out there, a criminal could build
a nice little passive income stream for themselves. If you ignore the fact this is kinda predatory
and on the whole not very nice, it is quite clever I think we have to admit.
All this would be done silently, the dodgy text messages wouldn’t even show in the
victim’s inbox - additionally paid text messages like this often require explicit
consent for a fee to be taken, Valdik noticed that the firmware secretly “intercepts [the]
confirmation SMS and sends a confirmation text in response.”
I’m not sure exactly who buys this kind of phone, I’m guessing just old people and
drug dealers. Which for criminals, are the perfect targets, elderly people likely won’t
realise they’re being scammed, and drug dealers aren’t in the best position to report
this kind of activity if they figure it out.
The question of course is who exactly is behind this scam? These simple phones are often white
labelled OEM products, meaning a manufacturer in China makes them without a brand name and
sells them in bulk to a company which sticks their own brand name on them. If you spend
just 5 minutes on wholesale websites like Alibaba it’s not difficult to find such
OEM phones at just a few dollars a piece.
Valdik is pointing the finger at the brands under which the phones are sold, alleging
that they’ve bought these OEM phones and modified the firmware before putting them
on the market. That makes the cost of setting up an operation like this quite low, as you
don’t need to actually develop a phone from scratch, and instead just spend a couple thousand
dollars on already made devices.
I doubt any of you guys are buying these kinds of phones, but if you are, pay a little extra
and go with a trusted brand like Nokia, give the unknown brands a miss.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes and follow my journey in creating products
for my pentester hardware company maltronics, make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
If you’re looking for something to watch next go check out my previous video on how
I discovered a scammer was masquerading as my manager and trying to scam companies out
of sponsorship money. I went undercover, setting up a call with him, before revealing my true
identity.
As always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.