They discover a vulnerability in Bluetooth that allows spying on conversations and obtaining private information

They find a new vulnerability in the Bluetooth standard, which would allow a third device to eavesdrop on private conversations and obtain private information.

For a couple of years now, practically every month we have encountered a new vulnerability. Security researchers seem to have worked hard to improve security for all users. a few days ago revealed Screwed Drivers and SWAPGS, to which is added a vulnerability in the Bluetooth standard. This allows an attack capable of obtaining information and the content of the hacked devices.

Vulnerabilities have expanded in recent years due to the increase in research in the field of cybersecurity. Specter and Meltdown were the first at the processor microarchitecture level and from which different revisions have been discovered. Screwed Drivers affects drivers from most manufacturers. Now it's time for the most popular wireless connection port on smartphones and portable devices.

They discover a serious vulnerability in the Bluetooth standard

Those who have discovered it are researchers from the Center for Information Security, Privacy and Accountability (CISPA in English). They have been the discoverers of this security breach and, as usual, they have published a report about it.

The Bluetooth standard creates a two-way channel encrypted by a key between the two devices. Researchers have discovered that a third device could be connected to this communication channel. It would create a much shorter encryption key, which can be obtained through a brute force attack.

KNOB or Bluetooth key negotiation is what this new vulnerability has been called. Through this system, a third party could listen to a conversation, intercept content or inject malware. This vulnerability would be present in almost twenty chips manufactured by Apple, Qualcomm, Intel, Broadcom and other companies in the sector.

This vulnerability would have received a series of patches that correct it. So this vulnerability, if we have the devices well updated, they should no longer be vulnerable.

Source: The Verge