A Bluetooth vulnerability dubbed BlueBorne, discovered in April, has been made public after companies including Google and Microsoft issued updates.
US-headquartered security company, Armis Lab, revealed the vulnerability on 12 September.
BlueBorne is an attack vector through which hackers can potentially use Bluetooth connections to access devices including computers, mobile phones and IoT devices.
Such an attack would not require the targeted device to be paired to the attacker’s device, or even to be set on discoverable mode. Armis Labs has identified eight zero-day vulnerabilities so far, which indicate the existence and potential of the attack vector.
Armis Labs estimates that more than 8 billion devices could be at risk. The vulnerabilities affect all devices running on Android, Linux, Windows and pre-version 10 of iOS operating systems, regardless of the Bluetooth version in use.
All iPhone, iPad and iPod touch devices with iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower are affected by the remote code execution vulnerability.
BlueBorne’s difference to other types of attack vectors is the fact that it spreads through the air, which according to Armis, allows it to spread with minimum effort.
The other major concern is that traditional security measures do not protect from this type of threat. Also, no action from a user is necessary to trigger the attack.
On 19 April, Armis Labs contacted Google and Microsoft about the vulnerability. Google released a public security update and security bulletin on 4 September.
Microsoft had already issued updates on 11 July.
Apple was contacted in August but it had no vulnerability in its current versions. Samsung was contacted on three separate occasions and did not respond to the security company.
Linux was also contacted in August, information was provided to the Linux kernel security team and to the Linux distributions security contact list.
