SB2020051907 - Bluetooth Impersonation Attack agains multiple vendors

Description

This security bulletin contains information about 1 security vulnerability.

1) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2020-10135)

The vulnerability allows a remote attacker to perform a Man-in-the-Middle (MitM) attack.

The vulnerability exists in the implementation of Bluetooth v5.0, v4.2, v4.1, v4.0 on devices manufactured by multiple vendors. A remote attacker with physical proximity to the victim can successful perform a MitM attack even against previously paired devices and gain access to sensitive information.

Below is the list of chips and devices, confirmed to be vulnerable:

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://francozappa.github.io/about-bias/publication/antonioli-20-bias/antonioli-20-bias.pdf